Apparatus, system and method for secure information dissemination

ABSTRACT

An apparatus transfers the title of content to an ID-assigning unit which assigns an ID to the content and transmits the content ID to a broadcasting unit via a tagging unit. A broadcasting apparatus then broadcasts the content ID and a receiver extracts the content ID from a received signal and transfers the content ID to a verification unit which determines whether or not the content ID received from a reception functional unit matches a stored content ID. If the content ID received from the reception unit matches a stored content ID, user information of the receiver is transmitted to a privacy-guarding unit. The privacy-guarding unit searches privacy-guarding items and, in accordance with a result of the search, only necessary user information presented by the verification unit is transmitted to a provider unit.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a divisional of U.S. patent application Ser. No.09/810,188, filed Mar. 19, 2001, and further is based upon and claimsthe benefit of priority from the prior Japanese Patent Application No.2000-077627, filed Mar. 21, 2000, the entire contents of each of whichare incorporated herein by reference.

BACKGROUND OF THE INVENTION

The present invention relates to an information processing apparatus, aninformation processing method, an information processing system and arecording medium. More particularly, the present invention relates to aninformation processing apparatus, an information processing method, aninformation processing system and a recording medium that allow acontent to be provided with a high degree of security through a network.

In recent years, there are more opportunities in which radio ortelevision broadcasting provides the radio listener or the televisionwatcher with information on commodities, information on services and avariety of contents. In this specification, the variety of contents arereferred to simply as a content if it is not necessary to distinguishthem from each other. Thus, a desired content can be presented to theradio listener or the television watcher speedily through the radio ortelevision broadcasting.

In such a system, however, a content provider faces a problem of muchlabor and much time required for forming a judgment as to whether or nota request for a content made by the radio listener or the televisionwatcher conforms to a correct form prescribed by the provider. Inaddition, it is feared that the radio listener or the television watchermaking a request for presentation of a content does not have thecapability of paying a fee for the content so that the provider cannotreceive a payment from the listener or the watcher.

Moreover, the radio listener or the television watcher receiving apresented content must provide the content provider with personalinformation such as the name, the address, the age, the telephone numberas well as a credit card number, and it is difficult to prevent thedisclosed personal information from being abused. Furthermore, in mostcases, the radio listener does not know what kind of enterprise thecontent provider is. Thus, while it is feared that the content providerpresents a poor content or does not really have a presented content, theradio listener itself must run a risk accompanying the transaction.

SUMMARY OF THE INVENTION

It is therefore an object of the present invention addressing theproblems described above to allow transactions to be closed speedilywith a high degree of security by the content provider and the contentrecipient.

An information processing apparatus provided by the present invention ischaracterized in that the information processing apparatus comprises anacquisition means for acquiring information on a first informationprocessing apparatus and information on a content presented by the firstinformation processing apparatus from the first information processingapparatus, a generation means for generating information processingapparatus identification information for identifying the firstinformation processing apparatus and generating content identificationinformation for identifying a content on the basis of the information onthe first information processing apparatus and the information on acontent, which are acquired by the acquisition means, a storage meansfor storing the information processing apparatus identificationinformation and the content identification information, which aregenerated by the generation means, by associating the informationprocessing apparatus identification information with the contentidentification information and a transmission means for transmittinginformation on association stored in the storage means to a secondinformation processing apparatus in response to a request made by thesecond information processing apparatus through a network.

It is possible to implement a configuration of the informationprocessing apparatus wherein, if the information processing apparatusidentification information and the content identification informationare disseminated by broadcasting, the acquisition means further acquiresbroadcasting identification information (transmission identificationinformation) assigned to the broadcasting, and the storage means furtherstores the broadcasting identification information (transmissionidentification information) by associating the broadcastingidentification information (transmission identification information)with the information processing apparatus identification information andthe content identification information.

It is possible to implement a configuration of the informationprocessing apparatus wherein the storage means further stores theaddress of the first information processing apparatus in the network andis further provided with an access controlling means for controllingaccesses made to the first information processing means through thenetwork on the basis of any one of the information processing apparatusidentification information, the content identification information andthe broadcasting identification information (transmission identificationinformation), which have been acquired from a third informationprocessing apparatus.

It is possible to implement a configuration of the informationprocessing apparatus wherein the acquisition means further acquires avalidity-condition concerning validity of presentation of a content fromthe first information processing apparatus, whereas the storage meansfurther stores the validity-condition by associating thevalidity-condition with the information processing apparatusidentification information and the content identification information.

It is possible to implement a configuration of the informationprocessing apparatus wherein the validity-condition includes informationon additional information added by the user receiving data including theinformation processing apparatus identification information and thecontent identification information.

An information processing method provided by the present invention ischaracterized in that the information processing method comprises anacquisition step of acquiring information on a first informationprocessing apparatus and information on a content presented by the firstinformation processing apparatus from the first information processingapparatus, a generation step of generating information processingapparatus identification information for identifying the firstinformation processing apparatus and generating content identificationinformation for identifying a content on the basis of the information ona first information processing apparatus and the information on acontent, which are acquired by the processing at the acquisition step, astorage step of storing the information processing apparatusidentification information and the content identification information,which are generated by the processing at the generation step, byassociating the information processing apparatus identificationinformation with the content identification information and atransmission step of transmitting information on association stored bythe processing at the storage step to a second information processingapparatus in response to a request made by the second informationprocessing apparatus through a network.

A recording medium provided by the present invention is characterized inthat a program recorded on the recording medium comprises an acquisitionstep of acquiring information on a first information processingapparatus and information on a content presented by the firstinformation processing apparatus from the first information processingapparatus, a generation step of generating information processingapparatus identification information for identifying the firstinformation processing apparatus and generating content identificationinformation for identifying a content on the basis of the information ona first information processing apparatus and the information on acontent, which are acquired by the processing at the acquisition step, astorage controlling step of controlling storage of the informationprocessing apparatus identification information and the contentidentification information, which are generated by the processing at thegeneration step, by associating the information processing apparatusidentification information with the content identification informationand a transmission step of transmitting information on associationstored by the processing at the storage controlling step to a secondinformation processing apparatus in response to a request made by thesecond information processing apparatus through a network.

Another information processing apparatus provided by the presentinvention is characterized in that the information processing apparatuscomprises an extraction means for extracting content identificationinformation for identifying a content presented by a first informationprocessing apparatus and first information processing apparatusidentification information for identifying the first informationprocessing apparatus from a received signal, a storage means for storingsecond information processing apparatus identification information foridentifying the other information processing apparatus itself and arequest means for transmitting the content identification informationand the first information processing apparatus identificationinformation, which are extracted by the extraction means, along with thesecond information processing apparatus identification informationstored in the storage means to a second information processing apparatusso as to request the first information processing apparatus to present acontent identified by the content identification information.

It is possible to implement a configuration of the other informationprocessing apparatus wherein the other information processing apparatusfurther includes a transfer means for transferring the secondinformation processing apparatus identification information in advanceto the second information processing apparatus for storing the secondinformation processing apparatus identification information.

It is possible to implement a configuration of the other informationprocessing apparatus wherein the extraction means is further providedwith an acquisition means for further extracting additional relatedinformation related to additional data added by a user and acquiring theadditional data related to the additional related information.

It is possible to implement a configuration of the other informationprocessing apparatus wherein, if the first information processingapparatus identification information and the content identificationinformation are disseminated by broadcasting, the extraction meansfurther extracts broadcasting identification information assigned to thebroadcasting, and the storage means further stores the broadcastingidentification information (transmission identification information) byassociating the broadcasting identification information (transmissionidentification information) with the first information processingapparatus identification information and the content identificationinformation.

Another information processing method provided by the present inventionis characterized in that the information processing method comprises anextraction step of extracting content identification information foridentifying a content presented by a first information processingapparatus and first information processing apparatus identificationinformation for identifying the first information processing apparatusfrom a received signal, storage step of storing second informationprocessing apparatus identification information for identifying aninformation processing apparatus adopting the other informationprocessing method itself and a request step of transmitting the contentidentification information and the first information processingapparatus identification information, which are extracted by theprocessing at the extraction step, along with the second informationprocessing apparatus identification information stored by the processingat the storage step to a second information processing apparatus so asto request the first information processing apparatus to present acontent identified by the content identification information.

Another recording medium provided by the present invention ischaracterized in that a program recorded on the recording mediumcomprises an extraction step of extracting content identificationinformation for identifying a content presented by a first informationprocessing apparatus and first information processing apparatusidentification information for identifying the first informationprocessing apparatus from a received signal, storage step of storingsecond information processing apparatus identification information foridentifying an information processing apparatus executing the programitself and a request step of transmitting the content identificationinformation and the first information processing apparatusidentification information, which are extracted by the processing at theextraction step, along with the second information processing apparatusidentification information stored by the processing at the storage stepto a second information processing apparatus so as to request the firstinformation processing apparatus to present a content identified by thecontent identification information.

A further information processing apparatus provided by the presentinvention is characterized in that the information processing apparatuscomprises a first acquisition means for acquiring content identificationinformation for identifying a content presented by a first informationprocessing apparatus, first information processing apparatusidentification information for identifying the first informationprocessing apparatus and second information processing apparatusidentification information for identifying a second informationprocessing apparatus from the second information identifying apparatus,a judgment means for forming a judgment on validity of the contentidentification information, the first information processing apparatusidentification information and the second information processingapparatus identification information which are acquired by the firstacquisition means, a second acquisition means for acquiring userinformation on a user of the second information processing apparatus andan output means for outputting the user information acquired by thesecond acquisition means in conformity with a result of the judgmentformed by the judgment means as information for receiving a presentedcontent identified by the content identification information.

It is possible to implement a configuration of the further informationprocessing apparatus wherein, if the first information processingapparatus identification information and the content identificationinformation are disseminated by broadcasting, the first acquisitionmeans further acquires broadcasting identification information(transmission identification information) assigned to the broadcasting,and the judgment means further forms a judgment on validity of thecontent identification information, the first information processingapparatus identification information, the second information processingapparatus identification information and the broadcasting identificationinformation (transmission identification information).

It is possible to implement a configuration of the further informationprocessing apparatus wherein the first acquisition means furtheracquires additional information and the judgment means further forms ajudgment on validity of the additional information.

It is possible to implement a configuration of the further informationprocessing apparatus wherein there is further included an assignmentmeans for assigning customer identification information for identifyinga customer to the content identification information, the firstinformation processing apparatus identification information and thesecond information processing apparatus identification information.

It is possible to implement a configuration of the further informationprocessing apparatus wherein the output means outputs the customeridentification information instead of outputting the second informationprocessing apparatus identification information among pieces ofinformation for receiving the content.

It is possible to implement a configuration of the further informationprocessing apparatus wherein there is further included a request meansfor requesting the first information processing apparatus to present acontent identified by the content identification information through anetwork instead of requesting the second information processingapparatus.

It is possible to implement a configuration of the further informationprocessing apparatus wherein there is further included a presentationmeans for directly or indirectly presenting a content identified by thecontent identification information to the second information processingapparatus in place of the first information processing apparatus.

A further information processing method provided by the presentinvention is characterized in that the information processing methodcomprises a first acquisition controlling step of controllingacquisition, from the second information identifying apparatus, ofcontent identification information for identifying a content presentedby a first information processing apparatus, first informationprocessing apparatus identification information for identifying thefirst information processing apparatus and second information processingapparatus identification information for identifying a secondinformation processing apparatus, a judgment step of forming a judgmenton validity of the content identification information, the firstinformation processing apparatus identification information and thesecond information processing apparatus identification information,whose acquisition is controlled by the processing at the firstacquisition controlling step, a second acquisition controlling step ofcontrolling acquisition of user information on a user of the secondinformation processing apparatus and an output step of outputting theuser information, whose acquisition is controlled by the processing atthe second acquisition controlling step in conformity with a result ofthe judgment formed by the processing at the judgment step asinformation for receiving the content identified by the contentidentification information.

A further recording medium provided by the present invention ischaracterized in that a program recorded on the recording mediumcomprises a first acquisition controlling step of controllingacquisition, from the second information identifying apparatus, ofcontent identification information for identifying a content presentedby a first information processing apparatus, first informationprocessing apparatus identification information for identifying thefirst information processing apparatus and second information processingapparatus identification information for identifying a secondinformation processing apparatus, a judgment step of forming a judgmenton validity of the content identification information, the firstinformation processing apparatus identification information and thesecond information processing apparatus identification information,whose acquisition is controlled by the processing at the firstacquisition controlling step, a second acquisition controlling step ofcontrolling acquisition of user information on a user of the secondinformation processing apparatus and an output step of outputting theuser information, whose acquisition is controlled by the processing atthe second acquisition controlling step in conformity with a result ofthe judgment formed by the processing at the judgment step asinformation for receiving the content identified by the contentidentification information.

A still further information processing apparatus provided by the presentinvention is characterized in that the information processing apparatuscomprises an acquisition means for acquiring content identificationinformation for identifying a content, first information processingapparatus identification information for identifying a first informationprocessing apparatus and second information processing apparatusidentification information for identifying a second informationprocessing apparatus to receive a presented content, an assignment meansfor assigning customer identification information for identifying acustomer to the content identification information, the firstinformation processing apparatus identification information and thesecond information processing apparatus identification information, arequest means for requesting the first information processing apparatusto present a content identified by the content identificationinformation through a network instead of requesting the secondinformation processing apparatus and an output means for outputtingcustomer identification information to the first information processingapparatus through the network as information for receiving the contentinstead of outputting the second information processing apparatusidentification information.

It is possible to implement a configuration of the still furtherinformation processing apparatus wherein there is further included apresentation means for directly or indirectly presenting a contentidentified by the content identification information to the secondinformation processing apparatus in place of the first informationprocessing apparatus.

A still further information processing method provided by the presentinvention is characterized in that the information processing methodcomprises an acquisition controlling step of controlling acquisition ofcontent identification information for identifying a content, firstinformation processing apparatus identification information foridentifying a first information processing apparatus and secondinformation processing apparatus identification information foridentifying a second information processing apparatus to receive apresented content, an assignment step of assigning customeridentification information for identifying a customer to the contentidentification information, the first information processing apparatusidentification information and the second information processingapparatus identification information, a request step of requesting thefirst information processing apparatus to present a content identifiedby the content identification information through a network instead ofrequesting the second information processing apparatus and output stepof outputting customer identification information to the firstinformation processing apparatus through the network as information forreceiving the content instead of outputting the second informationprocessing apparatus identification information.

A still further recording medium provided by the present invention ischaracterized in that a program recorded on the recording mediumcomprises an acquisition controlling step of controlling acquisition ofcontent identification information for identifying a content, firstinformation processing apparatus identification information foridentifying a first information processing apparatus and secondinformation processing apparatus identification information foridentifying a second information processing apparatus to receive thecontent, an assignment step of assigning customer identificationinformation for identifying a customer to the content identificationinformation, the first information processing apparatus identificationinformation and the second information processing apparatusidentification information, a request step of requesting the firstinformation processing apparatus to present a content identified by thecontent identification information through a network instead ofrequesting the second information processing apparatus and output stepof outputting customer identification information to the firstinformation processing apparatus through the network as information forreceiving a presented content instead of outputting the secondinformation processing apparatus identification information.

An information processing system provided by the present invention ischaracterized in that the information processing system includes asecond information processing apparatus comprising, a first acquisitionmeans for acquiring information on a first information processingapparatus and information on a content presented by the firstinformation processing apparatus from the first information processingapparatus, a generation means for generating first informationprocessing apparatus identification information for identifying thefirst information processing apparatus and generating contentidentification information for identifying a content on the basis of theinformation on the first information processing apparatus and theinformation on a content, which are acquired by the first acquisitionmeans, a first storage means for storing the first informationprocessing apparatus identification information and the contentidentification information, which are generated by the generation means,by associating the information processing apparatus identificationinformation with the content identification information, a first outputmeans for directly or indirectly outputting the first informationprocessing apparatus identification information and the contentidentification information, which are stored in the first storage means,to a third information processing apparatus and a transmission means fortransmitting information on association stored in the first storagemeans to a fourth information processing apparatus in response to arequest made by the fourth information processing apparatus through anetwork, the third information processing means comprising an extractionmeans for extracting the content identification information and thefirst information processing apparatus identification information from areceived signal, a second storage means for storing second informationprocessing apparatus identification information for identifying thethird information processing apparatus itself and a request means fortransmitting the content identification information and the firstinformation processing apparatus identification information, which areextracted by the extraction means, along with the second informationprocessing apparatus identification information stored in the secondstorage means to a fourth information processing apparatus so as torequest the first information processing apparatus to present a contentidentified by the content identification information, and the fourthinformation processing means comprising a second acquisition means foracquiring the content identification information, the first informationprocessing apparatus identification information and the secondinformation processing apparatus identification information from thethird information processing apparatus, a judgment means for forming ajudgment on validity of the content identification information, thefirst information processing apparatus identification information andthe second information processing apparatus identification informationwhich are acquired by the second acquisition means, a third acquisitionmeans for acquiring user information on a user of the third informationprocessing apparatus and a second output means for outputting the userinformation acquired by the third acquisition means in conformity with aresult of the judgment formed by the judgment means as information forreceiving the content identified by the content identificationinformation.

A still other information processing method provided by the presentinvention is characterized in that the information processing methodincludes an information processing method for a second informationprocessing apparatus comprising a first acquisition controlling step ofcontrolling acquisition, from the first information processingapparatus, of information on a first information processing apparatusand information on a content presented by the first informationprocessing apparatus, a generation step of generating first informationprocessing apparatus identification information for identifying thefirst information processing apparatus and generating contentidentification information for identifying a content on the basis of theinformation on the first information processing apparatus and theinformation on a content, whose acquisition is controlled by theprocessing at the first acquisition controlling step, a first storagecontrolling step of controlling storage of the first informationprocessing apparatus identification information and the contentidentification information, which are generated by the processing at thegeneration step, by associating the information processing apparatusidentification information with the content identification information,a first output controlling step of directly or indirectly controllingoutput of the first information processing apparatus identificationinformation and the content identification information, whose storage iscontrolled by the processing at the first storage controlling step, to athird information processing apparatus and a transmission controllingstep of controlling transmission of information on association, whosestorage is controlled by the processing at the first storage controllingstep to a fourth information processing apparatus in response to arequest made by the fourth information processing apparatus through anetwork, an information processing method for the third informationprocessing apparatus comprising an extraction controlling step ofcontrolling extraction of the content identification information and thefirst information processing apparatus identification information from areceived signal, a second storage controlling step of controllingstorage of second information processing apparatus identificationinformation for identifying the third information processing apparatusitself and a request step of transmitting the content identificationinformation and the first information processing apparatusidentification information, whose extraction is controlled by theprocessing at the extraction controlling step, along with the secondinformation processing apparatus identification information, whosestorage is controlled by the processing at the second storagecontrolling step to a fourth information processing apparatus so as torequest the first information processing apparatus to present a contentidentified by the content identification information, and the aninformation processing method for fourth information processingapparatus comprising a second acquisition controlling step ofcontrolling acquisition of the content identification information, thefirst information processing apparatus identification information andthe second information processing apparatus identification informationfrom the third information processing apparatus, a judgment step offorming a judgment on validity of the content identificationinformation, the first information processing apparatus identificationinformation and the second information processing apparatusidentification information, whose acquisition is controlled by theprocessing at the second acquisition controlling step, a thirdacquisition controlling step of controlling acquisition of userinformation on a user of the third information processing apparatus anda second output controlling step of controlling output of the userinformation, whose acquisition is controlled by the processing at thethird acquisition controlling step in conformity with a result of thejudgment formed by the processing at the judgment step as informationfor receiving a presented content identified by the contentidentification information.

A still other recording medium provided by the present invention ischaracterized in that a program recorded on the recording mediumcomprises an information processing method for a second informationprocessing apparatus comprising a first acquisition controlling step ofcontrolling acquiring of information on a first information processingapparatus and information on a content presented by the firstinformation processing apparatus from the first information processingapparatus, a generation step of generating first information processingapparatus identification information for identifying the firstinformation processing apparatus and generating content identificationinformation for identifying a content on the basis of the information onthe first information processing apparatus and the information on acontent, whose acquisition is controlled by the processing at the firstacquisition controlling step, a first storage controlling step ofcontrolling storage of the first information processing apparatusidentification information and the content identification information,which are generated by the processing at the generation step, byassociating the information processing apparatus identificationinformation with the content identification information, a first outputcontrolling step of directly or indirectly controlling output of thefirst information processing apparatus identification information andthe content identification information, whose storage is controlled bythe processing at the first storage controlling step, to a thirdinformation processing apparatus and a transmission controlling step ofcontrolling transmission of information on association, whose storage iscontrolled by the processing at the first storage controlling step to afourth information processing apparatus in response to a request made bythe fourth information processing apparatus through a network, aninformation processing method for the third information processingapparatus comprising an extraction controlling step of controllingextraction of the content identification information and the firstinformation processing apparatus identification information from areceived signal, a second storage controlling step of controllingstorage second information processing apparatus identificationinformation for identifying the third information processing apparatusitself and a request step of transmitting the content identificationinformation and the first information processing apparatusidentification information, whose extraction is controlled by theprocessing at the extraction controlling step, along with the secondinformation processing apparatus identification information, whosestorage is controlled by the processing at the second storagecontrolling step to a fourth information processing apparatus so as torequest the first information processing apparatus to present a contentidentified by the content identification information and the aninformation processing method for fourth information processingapparatus comprising, a second acquisition controlling step ofcontrolling acquisition of the content identification information, thefirst information processing apparatus identification information andthe second information processing apparatus identification informationfrom the third information processing apparatus, a judgment step offorming a judgment on validity of the content identificationinformation, the first information processing apparatus identificationinformation and the second information processing apparatusidentification information, whose acquisition is controlled by theprocessing at the second acquisition controlling step, a thirdacquisition controlling step of controlling acquisition of userinformation on a user of the third information processing apparatus anda second output controlling step of controlling output of the userinformation, whose acquisition is controlled by the processing at thethird acquisition controlling step in conformity with a result of thejudgment formed by the processing at the judgment step as informationfor receiving a presented content identified by the contentidentification information.

In the information processing apparatus as well as the informationprocessing method, which are provided by the invention, and the programrecorded on the recording medium also provided by the invention,information on a relation between stored content identificationinformation and stored information processing apparatus identificationinformation is transmitted to the second information processingapparatus at a request made by the second information processingapparatus by way of network.

In the other information processing apparatus as well as the otherinformation processing method, which are provided by the invention, andthe program recorded on the other recording medium also provided by theinvention, extracted content identification information and firstinformation processing apparatus identification information aretransmitted to the second information processing apparatus along withsecond information processing apparatus identification information so asto make a request for presentation of a content identified by thecontent identification information.

In the further information processing apparatus as well as the furtherinformation processing method, which are provided by the invention, andthe program recorded on the further recording medium also provided bythe invention, user information is output in conformity with a result ofa judgment on validity of acquired content identification information,first information processing apparatus identification information andsecond information processing apparatus identification information asinformation for receiving a presented content identified by the contentidentification information.

In the still further information processing apparatus as well as thestill further information processing method, which are provided by theinvention, and the program recorded on the still further recordingmedium also provided by the invention, customer identificationinformation assigned to content identification information, firstinformation processing apparatus identification information and secondinformation processing apparatus identification information is output tothe first information processing apparatus through the network asinformation for receiving a presented content instead of outputting thesecond information processing apparatus identification information.

In the information processing system as well as the still otherinformation processing method, which are provided by the invention, andthe program recorded on the still other recording medium also providedby the invention, the second information processing apparatus storesfirst information processing apparatus identification information andcontent identification information by associating the informationprocessing apparatus identification information with the contentidentification information directly or indirectly outputs the firstinformation processing apparatus identification information and thecontent identification information to the third information processingapparatus and transmits stored information on association to the fourthinformation processing apparatus in response to a request made by thefourth information processing apparatus. The third informationprocessing apparatus transmits the content identification informationand the first information processing apparatus identificationinformation, which are extracted from a signal received from the secondinformation processing apparatus, to a fourth information processingapparatus along with the second information processing apparatusidentification information so as to request the first informationprocessing apparatus to present a content identified by the contentidentification information. The fourth information processing apparatusforms a judgment on validity of the content identification information,the first information processing apparatus identification informationand the second information processing apparatus identificationinformation and outputs stored user information in conformity with aresult of the judgment as information for receiving a presented contentidentified by the content identification information.

In accordance with an information processing apparatus as well as aninformation processing method, which are provided by the presentinvention, and a program recorded on a recording medium also provided bythe present invention, content identification information andinformation processing apparatus identification information are recordedby associating one information with the other. When a second informationprocessing apparatus makes a request for stored information, the storedinformation is transmitted to the second information processingapparatus. It is thus possible to render a service allowing the secondinformation processing apparatus to identify a presented content.

In accordance with another information processing apparatus as well asanother information processing method, which are provided by the presentinvention, and a program recorded on another recording medium alsoprovided by the present invention, extracted content identificationinformation and first information processing apparatus identificationinformation are transmitted to a second information processing apparatusalong with second information processing apparatus identificationinformation as a request for presentation of a content issued to a firstinformation processing apparatus. Thus, a presented content can bereceived in a simple way and with a high degree of security.

In accordance with a further information processing apparatus as well asa further information processing method, which are provided by thepresent invention, and a program recorded on a further recording mediumalso provided by the present invention, a judgment is formed on validityof content identification information, first information processingapparatus identification information and second information processingapparatus identification information, whereas stored user information isoutput in conformity with a result of the judgment. It is thus possibleto render a service of providing the user with a content with a highdegree of security.

In accordance with a still further information processing apparatus aswell as a still further information processing method, which areprovided by the present invention, and a program recorded on a stillfurther recording medium also provided by the present invention,customer identification information for identifying a customer isassigned to content identification information, first informationprocessing apparatus identification information and second informationprocessing apparatus identification information, and the customeridentification information is output to a first information processingapparatus for presenting a content as information for receiving apresented content instead of outputting the second informationprocessing apparatus identification information. As a result, a contentcan be provided by the first information processing apparatus andreceived by a customer by hiding the first information processingapparatus and the second information processing apparatus from eachother.

In accordance with an information processing system as well as a stillother information processing method, which are provided by the presentinvention, and a program recorded on a still other recording medium alsoprovided by the present invention, a second information processingapparatus generates content identification information for identifying acontent presented from the first information. A third informationprocessing apparatus transmits a content identification informationextracted from a received signal to a fourth information processingapparatus so as to request a first information processing apparatus topresent a content identified by the content identification information,and the fourth information processing apparatus forms a judgment onvalidity of the content identification information received from thethird information processing apparatus and outputs information on a useroperating the third information processing apparatus as information forreceiving a presented content in accordance with a result of thejudgrnent. As a result, it is possible to implement a system wherein thefirst information processing apparatus is capable of presenting acontent to the third information processing apparatus with a high degreeof security.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram showing a typical configuration of aninformation processing system provided by the present invention.

FIG. 2 is a block diagram showing the configuration of functionalelements employed in the information processing system of FIG. 1.

FIG. 3 is a block diagram showing a typical configuration of aID-assigning server employed in the information processing system ofFIG. 1.

FIG. 4 is a flowchart used for explaining processing carried out by theinformation processing system shown in FIG. 1.

FIG. 5 is a continuation flowchart used for explaining processingcarried out by the information processing system shown in FIG. 1.

FIG. 6 is a continuation flowchart used for explaining processingcarried out by the information processing system shown in FIG. 1.

FIG. 7 is a continuation flowchart used for explaining processingcarried out by the information processing system shown in FIG. 1.

FIG. 8 is a continuation flowchart used for explaining processingcarried out by the information processing system shown in FIG. 1.

FIG. 9 is a continuation flowchart used for explaining processingcarried out by the information processing system shown in FIG. 1.

FIG. 10 is a continuation flowchart used for explaining processingcarried out by the information processing system shown in FIG. 1.

FIG. 11 is a continuation flowchart used for explaining processingcarried out by the information processing system shown in FIG. 1.

FIG. 12 is an explanatory diagram showing information stored in adatabase employed in an ID-assigning functional unit employed in theinformation processing system shown in FIG. 2.

FIG. 13 is a diagram showing a typical validity-condition.

FIG. 14 is an explanatory diagram showing a more detailed functions of atagging functional unit employed in the information processing systemshown in FIG. 2.

FIG. 15 is an explanatory diagram showing more detailed functions of atag-decoding functional unit employed in the information processingsystem shown in FIG. 2.

FIG. 16 is an explanatory diagram showing more detailed functions of areceiver employed in the information processing system shown in FIG. 2.

FIG. 17 is an explanatory diagram showing profile-information stored ina reception functional unit employed in the information processingsystem shown in FIG. 2.

FIG. 18 is an explanatory diagram showing typical information stored ina database of a receiver-management functional unit employed in theinformation processing system shown in FIG. 2.

FIG. 19 is an explanatory diagram showing a response condition.

FIG. 20 is an explanatory diagram showing other information stored inthe database of the receiver-management functional unit employed in theinformation processing system shown in FIG. 2.

FIG. 21 is an explanatory diagram showing more detailed functions of aprivacy-guarding functional unit employed in the information processingsystem shown in FIG. 2.

FIG. 22 is an explanatory diagram showing information stored in adatabase of the privacy-guarding functional unit employed in theinformation processing system shown in FIG. 2.

FIG. 23 is a diagram showing an external view of a typical configurationof the receiver employed in the information processing system shown inFIG. 1.

FIG. 24 is a diagram showing a typical electrical configuration of thereceiver shown in FIG. 23.

FIG. 25 is an explanatory diagram showing timings of questions includedin a program broadcasted by a broadcasting apparatus employed in theinformation processing system shown in FIG. 1.

FIG. 26 is a flowchart used for explaining reception processing carriedout by the receiver shown in FIG. 24.

FIG. 27 is a flowchart used for explaining details of processing carriedout in answer-data transmission-mode at a step S90 of the flowchartshown in FIG. 26.

FIG. 28 is a flowchart used for explaining details of processing carriedout by the receiver shown in FIG. 24 to purchase content data.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

FIG. 1 is a diagram showing a typical configuration of an informationprocessing system provided by the present invention. In this typicalconfiguration, a provider apparatus 2, an ID-assigning server 3, atagging server 4, a broadcasting apparatus 5, a verification server 7, aprivacy-guarding server 8, a commerce server 9 and a receiver 10 areconnected to the Internet 1. It should be noted, however, that if thereceiver 10 is not a receiver used at home, that is, if the receiver 10is a portable receiver or a receiver mounted on a vehicle, the receiver10 can be connected to the verification server 7 by a radio network. Thebroadcasting apparatus 5 transmits a broadcast electric wave from anantenna 6 to a satellite 21. On the other hand, the receiver 10 receivesan electric wave from the satellite 21 by using an antenna 11.

A provider providing contents, the administrators of the ID-assigningserver 3, the tagging server 4, the broadcasting apparatus 5, theverification server 7, the privacy-guarding server 8 and the commerceserver 9 make contracts with each other, each pay a predetermined amountof security money and each request that predetermined pieces ofprocessing be carried out.

It should be noted that the network can of course be other than theInternet 1.

In addition, it is needless to say that transmission from thebroadcasting apparatus 5 to the receiver 10 can be implemented by usingcommunication media other than the satellite 21. Examples of the othercommunication media are ground-wave broadcasting, broadcasting through acable, the Internet, a pager system and broadcasting by adoption of amulti-casting means using hand-phone lines.

FIG. 2 is a functional block diagram showing the elements employed inthe information processing system of FIG. 1, from the provider apparatus2 to the receiver 10. As shown in FIG. 2, the provider apparatus 2 ownedby a provider providing contents has a provider functional unit 41. Theprovider functional unit 41 has information used for introducingcontents provided by the provider to typically the listener listening toa radio broadcast. The information includes a provider name, that is,the name of the provider, the network address of the content providerand a presented content name, that is, the title of a presented content.The network address of the content provider is used by the listener tomake an access to the provider through the Internet 1.

The provider functional unit 41 also holds a validity-condition, whichis a condition for presenting a content provided by the provider. Thevalidity-condition includes an additional-information-inputting promptfor prescribing additional information to be entered by the listener.The additional information is information such as a string of charactersor a number specified individually by the user. The additionalinformation can be a response to a quiz, a response to a questionnaire,a number of a lottery, a password or the name of a commodity which ismentioned by the listener listening to a radio program. The providerfunctional unit 41 carries out processing to provide a content at arequest made by a content recipient.

The ID-assigning server 3 has an ID-assigning functional unit 42 and aprovider-address-identifying & connecting functional unit 44. Whenreceiving the name of a provider, the network address of the provider,the title of a content and a validity-condition including theadditional-information-inputting prompt from the provider functionalunit 41, the ID-assigning functional unit 42 assigns a provider ID foridentifying the content provider to the provider and assigns a contentID for identifying the content to the title of the content. TheID-assigning functional unit 42 stores the name of the provider, thenetwork address of the provider, the title of the content, the providerID, the content ID and the validity-condition in a database 43 byassociating one with another.

The provider-address-identifying & connecting functional unit 44identifies a content provider's network address corresponding to aprovider ID supplied by a privacy-guarding functional unit 50 on thebasis of information received from the ID-assigning functional unit 42,and carries out processing to make an access, by way of network, to aprovider functional unit 41 identified by the network address of thecontent provider.

The tagging server 4 has a tagging functional unit 45. When receiving aprovider ID, a content ID and the additional-information-inputtingprompt included in a validity-condition from the ID-assigning functionalunit 42, the tagging functional unit 45 adds a broadcasting reference IDto the provider ID, the content ID and theadditional-information-inputting prompt. The broadcasting referencenumber shows information related to broadcasting of the provider ID, thecontent ID and the additional-information-inputting prompt. Theinformation includes an order, media, a date and time and a channel ofthe broadcasting. The tagging functional unit 45 supplies thisbroadcasting reference ID to the ID-assigning functional unit 42 andstores the provider ID and the content ID in the database 43. Thetagging functional unit 45 further encodes the provider ID, the contentID, the additional-information-inputting prompt and the broadcastingreference ID into tag codes having a format suitable for broadcastingfrom the broadcasting apparatus 5 by way of the satellite 21 in a tagcoding process. The tagging functional unit 45 supplies the tag codes tothe broadcasting apparatus 5 by way of the Internet 1.

The broadcasting apparatus 5 has a broadcasting functional unit 46 forbroadcasting the tag codes received from the tagging functional unit 45employed in the tagging server 4 to the receiver 10 by way of theantenna 6 and the satellite 21.

The tag codes may be broadcasted by transmission other than the digitalradio broadcasting through the satellite 21. Examples of suchtransmission are digital television broadcasting through a satellite,ground-wave digital television broadcasting, ground-wave digital radiobroadcasting, transmission through a digital CATV network, transmissionthrough a pager data broadcasting network, Internet multi-castingtransmission and hand-phone multi-casting transmission. In this case,the tagging functional unit 45 carries out processing to convert theformat of the tag codes into a format of the transmission.

The receiver 10 comprises a reception functional unit 53 and atag-decoding functional unit 54. The reception functional unit 53receives digital broadcast data broadcasted by the broadcastingfunctional unit 46, and extracts tag-data from the digital broadcastdata. The reception functional unit 53 also forms a judgment as towhether the extracted tag-data is valid or invalid. If the extractedtag-data is determined to be valid, the reception functional unit 53supplies the data to the tag-decoding functional unit 54. If theextracted tag-data is determined to be invalid, on the other hand, thereception functional unit 53 informs the user of the invalidity.

In addition, the reception functional unit 53 stores a receiver-ID foridentifying the receiver 10 and personal information (orprofile-information) of a user (or a listener) such as the name of theuser, the postal address of the user and the age of the user. Ifnecessary, the reception functional unit 53 transmits the receiver-IDand the personal information to a receiver-management functional unit 48employed in the verification server 7 in advance to be stored in adatabase 49. That is to say, the user makes a contract with theadministrators of the verification server 7 and has the information onthe user itself stored in the database 49.

The tag-decoding functional unit 54 decodes tag-data received from thereception functional unit 53, and extracts a provider ID, a content ID,an additional-information-inputting prompt as well as a broadcastingreference ID. In addition, the tag-decoding functional unit 54 storesadditional information entered by the content recipient in response totypically an inquiry made by the content provider. For the additionalinformation entered by the content recipient, the tag-decodingfunctional unit 54 also generates a dynamically varying condition(information) as a response condition to be transmitted to averification functional unit 47 employed in the verification server 7.To put it concretely, the dynamically varying condition is informationon the user such as a time the additional information is entered and thename of a person entering the additional information.

The verification server 7 has the verification functional unit 47 andthe receiver-management functional unit 48. When receiving a providerID, a content ID and a broadcasting reference ID from the tag-decodingfunctional unit 54, the verification functional unit 47 examines thedatabase 43 of the ID-assigning functional unit 42 to determine whetheror not associated data is stored therein. In addition, the verificationfunctional unit 47 also determines whether a receiver-ID received fromthe reception functional unit 53 is valid or invalid. The verificationfunctional unit 47 also determines whether or not a response conditionreceived from the tag-decoding functional unit 54 matches avalidity-condition stored in the ID-assigning functional unit 42 inadvance.

The receiver-management functional unit 48 stores the receiver-ID of thereceiver 10 and profile-information (personal information) of the user,which are received from the reception functional unit 53 in advance, inthe database 49 for management purposes.

The privacy-guarding server 8 includes the privacy-guarding functionalunit 50. When privacy protection is selected in accordance withadditional information entered by the content recipient to thetag-decoding functional unit 54 and the privacy protection is approvedin accordance with a validity-condition stored in the database 43 of theID-assigning functional unit 42 by the provider functional unit 41, theprivacy-guarding functional unit 50 assigns a temporary customer numberto the receiver-ID of the receiver 10 in case there is a request forpresentation of a content identified by a content ID from theverification functional unit 47. An approval of privacy protectionindicates that the use of a privacy-guarding function is agreed on byboth the content provider providing a content and the content recipientreceiving the content. Then, the privacy-guarding functional unit 50supplies profile-information in a range approved in accordance with aresponse condition on the user side and a validity-condition on theprovider side to the provider-address-identifying & connectingfunctional unit 44 employed in the ID-assigning server 3 along with theprovider ID, the content ID and the customer number.

The commerce server 9 has the transaction functional unit 52. Thetransaction functional unit 52 supplies a content identified by acontent ID specified by the reception functional unit 53 (or the user)at a request made by the provider functional unit 41 or a request madeby the privacy-guarding functional unit 50.

FIG. 3 is a diagram showing a typical configuration of the ID-assigningserver 3. A CPU (Central Processing Unit) 61 carries out various kindsof processing by execution of a program stored in a ROM (Read OnlyMemory) 62 in advance or a program loaded into a RAM (Random AccessMemory) 63 from a storage unit 68. The RAM 63 is also used for storingdata required during the execution of the various kinds of processing bythe CPU 61.

As shown in the figure, the CPU 61, the ROM 62 and the RAM 63 areconnected to each other by a bus 64. An input/output interface 65 isalso connected to the bus 64.

The input/output interface 65 is connected to an input unit 66 includinga keyboard and a mouse, an output unit 67 including a display unit suchas a CRT or an LCD and a speaker, a storage unit 68 such as a hard diskand a communication unit 69 including a modem and a terminal adapter.The communication unit 69 carries out communications with otherapparatuses through the Internet 1.

If necessary, the input/output interface 65 is also connected to a drive70 for driving a memory device such as a magnetic disk 71, an opticaldisk 72, a magnetic optical disk 73 or a semiconductor memory 74. Aprogram can be read out from such a memory device and installed into thestorage unit 68 when needed.

It should be noted that the other servers each have basically the sameconfiguration as the ID-assigning server 3 even though theconfigurations of the other servers are shown in none of the figures.The broadcasting apparatus 5 communicates with the communication unit 69through the antenna 6 and the satellite 21. The configuration of thereceiver 10 will be explained later by referring to FIG. 23.

Operations are described by referring to a flowchart shown in FIGS. 4 to11 as follows.

The flowchart begins with a step S1 shown in FIG. 4 at which the contentprovider operates the provider apparatus 2 to transmit information fromthe provider functional unit 41 to the ID-assigning functional unit 42employed in the ID-assigning server 3 by way of the Internet 1. Theinformation includes the title of a provided content, its own name usedas a provider name, the content provider's network address used formaking an access to the provider apparatus 2 through the Internet 1 anda validity-condition including additional-information-inputting prompt,details of which will be described later by referring to FIG. 12. At thenext step S2, the ID-assigning functional unit 42 searches the database43 for a provider name matching the provider name received from theprovider functional unit 41.

At the next step S3, the ID-assigning functional unit 42 forms ajudgment as to whether or not the content provider's name received fromthe provider functional unit 41 has already been cataloged in thedatabase 43. If the content provider's name received from the providerfunctional unit 41 has not been cataloged in the database 43, the flowof the operations goes on to a step S4 at which a new provider ID isassigned to the content provider's name and the content provider's nameis cataloged in the database 43. The new ID is used as a provider ID. Ifthe outcome of the judgment formed at the step S3 indicates that thecontent provider's name received from the provider functional unit 41has already been cataloged in the database 43, on the other hand, theflow of the operations goes on to a step S5 at which the ID-assigningfunctional unit 42 reads out an ID assigned to the name of the contentprovider from the database 43 and used the ID as a provider ID.

The flow of the operations then goes on from the step S4 or S5 to a stepS6 at which the ID-assigning functional unit 42 assigns a new ID to atitle of the content received from the provider functional unit 41 anduses the assigned ID as a content ID. At the next step S7, theID-assigning functional unit 42 catalogs the provider ID, the content IDassigned at the step S6, the network address of the content provider andthe validity-condition received from the provider functional unit 41 atthe step S2 in the database 43 as a set of data. The cataloged providerID is the provider ID assigned at the step S4 or S5 whereas thecataloged network address of the content provider is the contentprovider's network address newly cataloged at the step S4 or the contentprovider's network address read out at the step S5 along with theprovider ID.

An example of the database 43 employed in the ID-assigning functionalunit 42 is shown in FIG. 12. As shown in the figure, the database 43includes content IDs such as 0001, 0002 and 0003, provider IDs such asRe0003 and Re0004, content provider network addresses such as www dotcdshop dot com and www dot books dot corn and content titles such as“Best Soundtrack”, “Symphony No. 5” and “Edison's Biography”. Forexample, the content ID 0001 is associated with the provider ID Re0003,the content provider network address www dot cdshop dot corn and thecontent title Best Soundtrack.

Further, a medium ID, a channel ID and an output time are added as abroadcasting reference ID.

The database 43 also includes table entry numbers 0001 to 0003 eachassociated with a content ID. Each table entry number is avalidity-condition shown in FIG. 13.

A validity-condition is a condition imposed by a content provider on acontent recipient or a content purchaser. As shown in FIG. 13, in avalidity-condition indicated by the table entry number 0001, a deadlinefor accepting a response is set at 23:59 on Oct. 5, 2001. In avalidity-condition indicated by the table entry number 0002, a deadlinefor accepting a response is set at 12:00 on Nov. 30, 2001. In avalidity-condition indicated by the table entry number 0003, a deadlinefor accepting a response is set at 23:59 on Dec. 2, 2001. A deadline foraccepting a response is a deadline by which a content recipient mustgive a response to an inquiry made by the content provider. That is tosay, a response received after the deadline is not accepted. To be morespecific, a response received after the time and the date specified inthe validity-condition is not accepted.

As shown in FIG. 13, in a validity-condition indicated by the tableentry number 0002, an age restriction is set at 18 years old. That is tosay, a content recipient responding to the validity-condition indicatedby the table entry number 0002 must be at least 18 years old. This agerestriction is not applicable (N/A) to a validity-condition indicated bythe table entry number 0001 and there is no age restriction (None) forvalidity-condition indicated by the table entry number 0003.

In a validity-condition indicated by the table entry number 0002, theprofile-information is classified to be an adult category. In avalidity-condition indicated by the table entry number 0003, theprofile-information is classified to be a child-oriented category. Thus,a content recipient responding to the validity-condition indicated bythe table entry number 0002 must be an adult of at least a predeterminedage and a content recipient responding to the validity-conditionindicated by the table entry number 0003 must be a child under apredetermined age.

In a validity-condition indicated by the table entry number 0002, apersonal-verification function is prescribed to be a registered person.Thus, a responding content recipient must be a registered user.

In a validity-condition indicated by the table entry number 0002, apayment means in the profile-information is prescribed to be use of acredit card such as JCB, VISA or AMEX, which are each a service mark. Ina validity-condition indicated by the table entry number 0003, thepayment means in the profile-information is prescribed to be use of abank check. The content recipient is required to pay a content fee byusing the prescribed method.

In a validity-condition indicated by the table entry number 0002, anarea restriction of a navigation function is prescribed to be all the USterritories except Alaska. In a validity-condition indicated by thetable entry number 0003, the area restriction of the navigation functionis prescribed to be California only. That is to say, a responder isrequired to be a resident or presently located in the prescribedterritory.

In a validity-condition indicated by the table entry number 0001, anadditional-information-inputting prompt is prescribed to require aninput of a string of 2 characters. In a validity-condition indicated bythe table entry number 0003, an additional-information-inputting promptis prescribed to require an input of a string of up to 3 characters.

In a validity-condition indicated by the table entry number 0001, input1 in the additional information, that is, a correct answer to a firstquestion of a quiz, is prescribed to be ‘ABC cola’. In avalidity-condition indicated by the table entry number 0003, input 1 inthe additional information prescribes the correct answer, which is anumber 1.

In a validity-condition indicated by the table entry number 0001, input2 in the additional information, that is, a correct answer to a secondquestion of a quiz, is prescribed to be ‘an ABC man’. The responder isrequired to enter these correct answers.

In a validity-condition indicated by the table entry number 0003, thelower limit of a balance of an account is prescribed to be 300 dollars.Thus, a content recipient is required to have a balance of an account ofat least 300 dollars.

By prescribing a validity-condition in advance as described above, acontent provider is capable of limiting content requesters to thosewithin a predetermined range.

At the next step S8 of the flowchart shown in FIG. 4, the ID-assigningfunctional unit 42 transmits the provider ID, the content ID, and theadditional-information-inputting prompt in the validity-condition to thetagging functional unit 45 through the Internet 1.

At the next step S9, the tagging functional unit 45 adds a broadcastingreference ID to the provider ID, the content ID and theadditional-information-inputting prompt. The broadcasting reference IDshows information related to broadcasting of the provider ID, thecontent ID and the additional-information-inputting prompt. Theinformation includes an order, media, a time and a channel type of thebroadcasting. In this embodiment, the tagging functional unit 45 encodesthe provider ID, the content ID, the additional-information-inputtingprompt and the broadcasting reference ID into tag codes having a formatsuitable for broadcasting from the broadcasting apparatus 5 to thereceiver 10 by way of the satellite 21.

FIG. 14 is a diagram showing a model of a tag coding process carried outby the tagging functional unit 45. As shown in the figure, in thetagging functional unit 45, an encryption unit 91 encrypts an inputcomprising a content ID of 0001, a provider ID of Re0003 and abroadcasting reference ID of BC0011 on the basis of a convention inputfrom a medium-selecting switch 93. In this embodiment, the convention isa selected one of a hand-phone multi-cast header & tag-data signalconvention 101, an Internet multi-cast header & tag-data signalconvention 102, a satellite television header & tag-data signalconvention 103, a satellite radio header & tag-data signal convention104, a ground-wave television header & tag-data signal convention 105, aground-wave radio header & tag-data signal convention 106, a CATV header& tag-data signal convention 107 or a satellite-data broadcasting header& tag-data signal convention 108. In the case of the example shown inFIG. 1, data is transmitted by satellite radio communication. Thus, theencryption is based on the satellite radio header & tag-data signalconvention 104.

It should be noted that, in order to form a judgment as to whether ornot data is correct in a self evaluation unit 153 to be explained laterby referring to FIG. 15, self evaluation based on a checksum is carriedout. The tagging functional unit 45 carries out also additionalprocessing based on this checksum.

A digital-data-inserting unit 92 further inserts predetermined databased on a convention selected by the medium-selecting switch 93 intothe data encrypted by the encryption unit 91. The digital-data-insertingunit 92 outputs aresult of insertion to the broadcasting functional unit46 employed in the broadcasting apparatus 5.

It should be noted that the encryption unit 91 can also be provided at astage following the digital-data-inserting unit 92.

At a step S10 of the flowchart shown in FIG. 5, the tagging functionalunit 45 supplies the broadcasting reference ID allocated at the step S9along with the corresponding information such as a broadcasting time,communication media and a channel type to the ID-assigning functionalunit 42 which stores the broadcasting reference ID and the correspondinginformation in the database 43.

Typical data cataloged in the database 43 is shown in FIG. 12. As shownin the figure, broadcasting reference IDs BC0011, BC0012 and BC0023 areassociated with content IDs 0001, 0002 and 0003 respectively. Thebroadcasting reference ID BC0011 is prescribed to have satellite radiocommunication media, a channel number of 112 and an output time of2:30:45 to 2:30:55. On the other hand, the broadcasting reference IDBC0012 is prescribed to have satellite radio communication media, achannel number of 134 and an output time of 3:35:15 to 3:35:25.

As described above, a broadcasting serial ID is associated withinformation such as communication media, a channel number and an outputtime. As an alternative, the communication media, the channel number andthe output time themselves are used as a broadcasting serial ID. Itshould be noted, however, that by prescribing a broadcasting serial IDin terms of a number or a symbol other than the communication media, thechannel number and the output time, the table shown in FIG. 12 can beupdated with ease.

At the next step S11, the tagging functional unit 45 transfers the tagcodes to the broadcasting functional unit 46 employed in thebroadcasting apparatus 5 by way of the Internet 1.

At the step S111, the broadcasting functional unit 46 employed in thebroadcasting apparatus 5 digitally multiplexes the tag codes receivedfrom the tagging functional unit 45 with real audio data of the programby adopting a method such as a watermark technique and then transmits aresult of multiplexing to the satellite 21 by way of the antenna 6. Theresult of multiplexing is eventually broadcasted to receivers 10 by thesatellite 21.

At the next step S12, the reception functional unit 53 employed in thereceiver 10 receives the broadcasted tag codes from the broadcastingfunctional unit 46 and transfers the tag codes to the tag-decodingfunctional unit 54. The tag-decoding functional unit 54 examines achecksum added to the tag codes in order to verify the validity of thetag codes. At the next step S13, the tag-decoding functional unit 54forms a judgment as to whether the tag codes are valid or invalid. Ifthe tag codes are determined to be invalid, the flow of the operationsgoes on to a step S14 at which the content recipient is informed of theinvalidity. The notice is given to the content recipient typically as avoice message output by the speaker 237 or a visible indicator output bya display control unit 248.

If the outcome of the judgment formed at the step S13 indicates that thetag codes are valid, on the other hand, the flow of the operations goeson to a step S15 at which the tag-decoding functional unit 54 decodesthe input tag codes, extracting the provider ID, the content ID, theadditional-information-inputting prompt and the broadcasting referenceID. The tag-decoding functional unit 54 then transfers the provider ID,the content ID, the additional-information-inputting prompt and thebroadcasting reference ID to the verification functional unit 47employed in the verification server 7 by way of the Internet 1.

FIG. 15 is a diagram showing a typical configuration of the tag-decodingfunctional unit 54 which carries out the processing of the step S15. Asshown in the figure, the tag-decoding functional unit 54 includes adata-extracting unit 151 for receiving data input from the receptionfunctional unit 53. The data-extracting unit 151 also receives aconvention selected by a medium-selecting switch 154 among thehand-phone multi-cast header & tag-data signal convention 101 to thesatellite-data broadcasting header & tag-data signal convention 108which have been mentioned earlier by referring to FIG. 14. Thedata-extracting unit 151 extracts necessary information from the inputdata on the basis of the received convention and supplies the extractedinformation to a decryption unit 152.

The decryption unit 152 carries out decryption processing also based onthe convention received from the medium-selecting switch 154. Thedecryption processing is a process opposite to the encryption carriedout by the encryption unit 91 shown in FIG. 14. The decryption unit 152outputs a result of decryption to a self evaluation unit 153 whichcarries out self evaluation on the decrypted data received from thedecryption unit 152 by using a checksum in order to form a judgment asto whether the decrypted data is a correct or incorrect result ofdecryption. If the decrypted data is a correct result of decryption, thecontent ID of 0001, the provider ID of Re0003 and the broadcastingreference ID of BC0011, which were input to the encryption unit 91 shownin FIG. 14, are acquired and transferred to the verification functionalunit 47.

Then, at a step S16 of the flowchart shown in FIG. 6, the tag-decodingfunctional unit 54 searches the tag codes for anadditional-information-inputting prompt. At the next step S17, thetag-decoding functional unit 54 forms a judgment as to whether or notthe tag codes include an additional-information-inputting prompt. If thetag codes include an additional-information-inputting prompt, the flowof the operations goes on to a step S118 at which the user (the contentrecipient) is prompted to enter additional information. The additionalinformation entered by the user is stored. If the provider functionalunit 41 requests the user to enter additional information such as aresponse to a quiz, a response to a questionnaire, a number of alottery, a password or the name of a commodity, a message is given tothe user, requesting the user to enter such additional information. Theadditional information entered by the user in response to the message isstored in a memory.

If the outcome of the judgment formed at the step S17 indicates that thetag codes do not include an additional-information-inputting prompt, onthe other hand, the processing of the step S18 is skipped.

If the outcome of the judgment formed at the step S17 indicates that thetag codes do not include an additional-information-inputting prompt, orafter the processing of the step S18 is completed, the flow of theoperations goes on to a step S19 at which the tag-decoding functionalunit 54 creates a response condition.

Processing to create a response condition is explained by referring toFIG. 16, which is a diagram showing functions related to the processingcarried out by the receiver 10 to create a response condition.

In this embodiment, a static condition of personal information of acontent recipient (a user) is treated as profile-information. On theother hand, a dynamic condition is treated as a response condition. Astatic condition is a condition that basically remains unchanged frominput to input while a dynamic condition varies from input to input. Adynamic condition entered by the user from time to time is treated asadditional information. Examples of the profile-information are a name,a gender, a postal address, an occupation, a cataloged territory, apayment means, an age and a consent condition. Profile-information isentered by the content recipient in advance through aprofile-information input/output functional unit 121 and stored in aprofile-information storage unit 122 in a typical format like one shownin FIG. 17. The consent condition is a condition on which presentationof profile-information of the content recipient to the content provideris based. In the example shown in FIG. 17, the consent condition isprescribed as “Except adults” indicating that the content recipient doesnot allow the profile-information of the content recipient to bepresented to a content provider presenting adult contents. A customernumber in the example shown in FIG. 17 indicates a customer numberassigned to the customer by a predetermined store. This customer numberis not a customer number assigned by the privacy-guarding functionalunit 50 to the customer as will be described later.

The profile-information stored in the profile-information storage unit122 is supplied to the receiver-management functional unit 48 by way ofthe profile-information input/output functional unit 121 to be stored inthe database 49 employed therein. FIG. 18 is a diagram showing typicalprofile-information stored in the database 49. The substances of theprofile-information stored in the database 49 are basically the same asthose of the profile-information shown in FIG. 17. However, theprofile-information shown in FIG. 18 includes a cataloging date, whichis a date on which this profile-information is cataloged. In addition,the profile-information shown in FIG. 18 also includes a receiver-IDoutput by a receiver-ID output functional unit 123 employed in thereceiver 10 to indicate that the profile-information is associated withthe receiver-ID.

A decoded-ID storage unit 131 is used for storing a content ID, aprovider ID and a broadcasting reference ID, which are obtained as aresult of decoding carried out by the tag-decoding functional unit 54.If necessary, these IDs are supplied to the verification functional unit47 by way of an ID output functional unit 132.

The receiver-ID output functional unit 123 supplies a receiver-ID storedin advance in the reception functional unit 53 to thereceiver-management functional unit 48 to be stored in the database 49thereof. In the example show in FIG. 18, a receiver-ID of Ssny1003 isstored in the database 49, being associated with other pieces ofprofile-information.

The receiver 10 comprises an account-balance-verifying functional unit133, a calendar timer 134, a navigation functional unit 135 and apersonal-verification functional unit 136. The account-balance-verifyingfunctional unit 133 checks a balance of an account owned by the contentrecipient. The calendar timer 134 generates the present time and thepresent date. The navigation functional unit 135 acquires the presentposition of the receiver 10. The personal-verification functional unit136 recognizes the fingerprint, the eyes or the like of the operator ofthe receiver 10 in order to identify the operator. Aresponse-condition-creating functional unit 137 creates a responsecondition from results of processing output by theaccount-balance-verifying functional unit 133, the calendar timer 134,the navigation functional unit 135 and the personal-verificationfunctional unit 136.

FIG. 19 is a diagram showing a typical response condition created by theresponse-condition-creating functional unit 137. A response date andtime included in the response condition are a date and a time at which aresponse is input. The creation of the response date and time is basedon the present time and date of 10:13 and Oct. 3, 2001 generated by thecalendar timer 134. The personal-verification functional unit 136 inputsimages of the fingerprint and the eyes of the operator of the receiver10, forming a judgment as to whether or not the images match those of afingerprint and eyes stored in advance. If they match each other, aphrase of “A cataloged person” is included in the response condition.

An area detected by a navigation function is created on the basis of apresent position detected by the navigation functional unit 135. In theexample shown in FIG. 19, the present position is the state ofCalifornia. A present balance of an account is created on the basis of aresult of verification produced by the account-balance-verifyingfunctional unit 133. In the example shown in FIG. 19, theaccount-balance-verifying functional unit 133 verifies the accountbalance of electronic money held in a memory employed in the receiver 10to find out that the balance is 342 dollars.

When the user enters additional information, an additional-informationinput/output functional unit 138 takes in the information and stores itin an additional-information storage unit 139. This processing iscarried out at the step S18 described earlier.

At the next step S19, the response-condition-creating functional unit137 transfers the response condition thus created to the verificationfunctional unit 47, or the additional-information storage unit 139transfers additional information stored therein to the verificationfunctional unit 47.

At the next step S20, the receiver-management functional unit 48examines the database 49 to determine whether or not the receiver 10connected to the verification server 7 is cataloged in the database 49.As described above, the receiver 10 has transmitted a response conditionand additional information to the verification functional unit 47. Toput it in detail, the verification functional unit 47 issues an inquiryabout the receiver-ID to the reception functional unit 53, and takes inthe receiver-ID output by the receiver-ID output functional unit 123 inresponse to the inquiry. The verification functional unit 47 also issuesa request for a transfer of profile-information to theprofile-information storage unit 122 employed in the receptionfunctional unit 53 through the profile-information input/outputfunctional unit 121. The receiver-management functional unit 48 comparesthe receiver-ID and the profile-information, which are taken in by theverification functional unit 47, with a receiver-ID andprofile-information, which are stored in the database 49 in advance.

FIG. 20 is a diagram showing typical receiver-IDs stored in the database49. In this cataloging example, cataloging dates of Jun. 5, 2000, Jun.6, 2000 and Jun. 6, 2000, user names of Taro Tanaka, Jiro Yamada andHanako Saito as well as model numbers of the receiver 10 of TS-S55,TS-S55 and TS-S55 are associated with receiver-IDs of Ssny1001, Ssny1003and Ssny1004 respectively.

Then, at the next step S21, the receiver-management functional unit 48forms a judgment as to whether or not the received receiver-ID and thereceived profile-information are correct, that is, match respectively areceiver-ID and profile-information, which are stored in the database 49in advance. If the received receiver-ID and the receivedprofile-information are not correct ones, the flow of the operationsgoes on to a step S22 at which the user is informed of the invaliditythrough the reception functional unit 53.

If the outcome of the judgment formed at the step S21 indicates that thereceived receiver-ID and the received profile-information are correctones, on the other hand, the flow of the operation goes on to a step S23at which the verification functional unit 47 forms a judgment as towhether or not the provider ID, the content ID and the broadcastingserial ID, which were received at the step S15 from the receptionfunctional unit 53, match respectively the provider ID, the content IDand the broadcasting serial ID, which were stored by the ID-assigningfunctional unit 42 in the processing carried out at the step S7. Thebroadcasting of the provider ID, the content ID and the broadcastingserial ID, which were stored by the ID-assigning functional unit 42, wasrequested by the provider functional unit 41. To put it in detail, theverification functional unit 47 issues an inquiry about a provider IDand a content ID associated with the broadcasting serial ID to theID-assigning functional unit 42 through the Internet 1. Then, theprovider ID, the content ID and the broadcasting serial ID, which areobtained as a response to the inquiry, are compared respectively withthe provider ID, the content ID and the broadcasting serial ID, whichwere received from the reception functional unit 53.

At the next step S24, the verification functional unit 47 forms ajudgment as to whether or not these IDs are IDs stored in the database43 of the ID-assigning functional unit 42 in advance, that is, whetherthe received IDs are correct ones. If the received receiver-ID and thereceived profile-information are not correct ones, the flow of theoperations goes on to a step S25 at which the user is informed of theinvalidity through the reception functional unit 53.

If the outcome of the judgment formed at the step S24 indicates that thereceived IDs are correct ones, on the other hand, the flow of theoperation goes on to a step S26 at which the verification functionalunit 47 examines whether or not the response condition received from theresponse-condition-creating functional unit 137 at the step S19 fallswithin the range of the validity-condition cataloged in advance in thedatabase 43 of the ID-assigning functional unit 42 at the step S7. Toput it in detail, the verification functional unit 47 issues a requestfor a transfer of a validity-condition associated with the broadcastingserial ID to the ID-assigning functional unit 42 and then compares thevalidity-condition transferred by the ID-assigning functional unit 42with the response condition.

Assume for example that a validity-condition with an entry number of0003 shown in FIG. 13 has been cataloged in the database 43 for thecontent ID of 0003 or the broadcasting serial ID of BC0023. Now, alsoassume for example that the response condition shown in FIG. 19 isacquired. As shown in FIG. 19, the present account balance is 342dollars, satisfying a validity-condition of ‘At least 300 dollars’ wherethe 300 dollars are the required minimum of the account balance.

In addition, a phrase of “The state of California” is prescribed as anarea detected by a navigation function in the response condition shownin FIG. 19. Since the area restriction of the validity-condition shownin FIG. 13 is prescribed to be “California only”, the area restrictionof the validity-condition is also satisfied. As the restriction on theresponse date and time, a time and a date of 23:59 and Dec. 2, 2001 areprescribed in the validity-condition shown in FIG. 13, while a time anda date of 10:13 and Oct. 3, 2001 are prescribed in the responsecondition shown in FIG. 19 as a response time and a response date. Thus,this restriction on the response date and time itself is not satisfied.That is to say, the response is given after the response deadline. Sincethe validity-condition for the personal-verification function shown inFIG. 13 is prescribed to be ‘not applicable’ (NA), the person verifiedto be cataloged as shown in FIG. 19 is determined to satisfy thisrestriction on the user itself without regard to whether or not the useris cataloged.

On the basis of results of the examination described above, at the nextstep S27, the verification functional unit 47 forms a judgment as towhether or not the response condition falls within the range of thevalidity-condition. If the response condition does not fall within therange of the validity-condition, the flow of the operations goes on to astep S28 at which the user is informed of this dissatisfaction throughthe reception functional unit 53. Since the response condition shown inFIG. 19 does not satisfy the restriction on the response date and timeof the validity-condition with an entry number of 0003 shown in FIG. 13,the outcome of the judgment formed at the step S27 indicates thedissatisfaction.

On the contrary, the response condition shown in FIG. 19 satisfies thevalidity-condition with an entry number of 0001 shown in FIG. 13. Inthis case, the flow of the operations goes on to a step S29 at which theverification functional unit 47 examines the additional information. Atthe next step S30, the verification functional unit 47 forms a judgmentas to whether or not the additional information falls within the rangeof the validity-condition. In the case of the validity-condition with anentry number of 0001 shown in FIG. 13, for example, the correct answersof the additional information, that is, the correct responses to a quiz,are ‘ABC cola’ and ‘ABC man’. If the user has entered answers other thanthe correct ones, the outcome of the judgment formed at the step S30indicates that the additional information does not fall within the rangeof the validity-condition. In this case, the flow of the operations goeson to a step S31 at which the user is informed of this dissatisfactionby the verification functional unit 47 through the reception functionalunit 53.

If the user has entered the correct answers, namely, the 2 phrases ‘ABCcola’, and ‘ABC man’ in responses to questions in the quiz, on the otherhand, the outcome of the judgment formed at the step S30 indicates thatthe additional information does fall within the range of thevalidity-condition. In this case, the flow of the operations goes on toa step S32 at which the verification functional unit 47 examines theprofile-information.

For example, assume that the profile-information of the user prescribesa phrase of ‘Under 18 years old.’ Since the validity-condition with anentry number of 0002 shown in FIG. 13 prescribes a phase of ‘At least 18years old,’ the profile-information is determined to not fall within therange of the validity-condition. Even with the profile-information ofthe user prescribing a phrase of ‘Over 18 years,’ if theprofile-information of the user prescribes a phrase of ‘Except adults’,the profile-information will be determined to not fall within the rangeof the validity-condition.

If the profile-information of the user prescribes a phrase of ‘Over 18years,’ and does not prescribe a phrase of ‘Except adults’ as arestriction on the contents, which indicates that an adult content isprohibited, the profile-information will be determined to satisfy therange of the validity-condition.

At the next step S33 of the flowchart shown in FIG. 8, the verificationfunctional unit 47 forms a judgment as to whether or not theprofile-information of the user falls within the range of thevalidity-condition. If the profile-information is determined to not fallwithin the range of the validity-condition, the flow of the operationsgoes on to a step S34 at which the user is informed of thedissatisfaction through the reception functional unit 53. If the outcomeof the judgment formed at the step S33 indicates that theprofile-information falls within the range of the validity-condition, onthe other hand, the flow of the operations goes on to a step S35 atwhich the verification functional unit 47 transmits the provider ID, thecontent ID and the receiver-ID, which were received from the receptionfunctional unit 53, to the privacy-guarding functional unit 50 by way ofthe Internet 1.

At the next step S36, the privacy-guarding functional unit 50 takes inprivacy-guarding items from the provider functional unit 41, theID-assigning functional unit 42, the reception functional unit 53 andthe verification functional unit 47.

For this reason, as shown in FIG. 21, the privacy-guarding functionalunit 50 is provided with saving functional units 171 to 174, anevaluation-judging functional unit 175, a management functional unit176, a privacy-guarding activation functional unit 177, aprivacy-guarding deactivation functional unit 178, a database-creatingfunctional unit 179 and an order-placing-unit 180.

The saving functional units 171, 172, 173 and 174 take inprivacy-guarding items from the verification functional unit 47, theID-assigning functional unit 42, the reception functional unit 53 andthe provider functional unit 41 respectively.

To put it in detail, trusted by the receiver 10 representing the userand the provider apparatus 2 representing the content provider, theprivacy-guarding functional unit 50 presents a content supplied by theprovider to the user and settles the account without giving the user'sname, postal address and network address to the provider. Thus, whilethe user of the receiver 10 and the content provider owning the providerapparatus 2 are of course capable of setting privacy-guarding items, inaccordance with the present invention, the administrators of theID-assigning server 3 and the verification server 7 are also capable ofsetting such items.

The privacy-guarding items are classified into fixed static items anddynamic items varying in dependence on conditions.

The user of the receiver 10 is capable of declaring that ‘items such asa postal address, a name, an annual income, and a network addressincluded in the user's own profile-information shall not be provided toany content provider whatsoever without the user's consent’ as a staticprivacy-guarding item. The fee for a presented content is paid throughthe privacy-guarding functional unit 50 by using a means prescribed inan item for a normal payment means in the profile-information.

In addition, the receiver 10 is capable of setting an item varying independence on for example the rating of a content provider as a dynamicprivacy-guarding item. The rating of a content provider is the categoryof the provider. For example, the rating of a content provider isdetermined by the number of contents produced by the provider,determined by the amount of security money deposited with theverification server 7, or determined by the age range of users providedwith contents, that is, determined by the category of the users such ashigh school students, university students or mature people.

With the rating of a content provider set at a predetermined value oftypically 3, the receiver 10 is capable of prescribing the following 2privacy-guarding items without regard to whether or not setting of aprivacy-guarding items prescribed by the content provider exists.

-   1: Declaration of any of the profile-information, the additional    information and the response condition as a privacy-guarding item    that the receiver 10 is capable of presenting.-   2: Declaration of any of a postal address, a name and a network    address in the profile-information as a privacy-guarding item of the    receiver 10 that needs to be protected by the privacy-guarding    functional unit 50 in reception of a presented content from a    content provider or declaration as to whether only broadcasting of    contents is to be treated as an operation entrusted to the    privacy-guarding functional unit 50 or settlement of accounts is to    be included in the operation entrusted to the privacy-guarding    functional unit 50.

With the rating of a content provider set at a value other than apredetermined value of typically 3, the receiver 10 is capable ofdeclaring that a request made by the content provider for aprivacy-guarding item is accepted as it is.

As an alternative, the receiver 10 declares that a privacy-guarding itembe set so that an order be placed with a content provider this timethrough a privacy-guarding function. In this way, the privacy-guardingfunction can be utilized on a case-by-case basis.

Examples of the static privacy-guarding items set by the providerapparatus 2 are the following two.

-   1: Declaration of any of the profile-information, the additional    information and the response condition, which are generated by the    receiver 10, as an item absolutely desired by the content provider.-   2: Declaration of any of a postal address, a name and a network    address in the profile-information as a privacy-guarding item of the    receiver 10 that needs to be protected by the privacy-guarding    functional unit 50 in presentation of a presented content to the    user by a content provider or declaration as to whether broadcasting    of contents or settlement of accounts is to be treated as an    operation entrusted to the privacy-guarding functional unit 50.

Typical dynamic privacy-guarding items of the provider apparatus 2 aredescribed as follows:

-   1: Declaration of any of the profile-information, the additional    information and the response condition, which are generated by the    receiver 10, as an item absolutely desired by the content provider.    If a portion showing the name of a country for the postal address    included in the profile-information, which is an item absolutely    desired by the content provider, is a territorial range specified in    advance by the provider, that is, if the country is Japan, for    example, the following privacy-guarding item (2) is applicable.    Otherwise, the following privacy-guarding item (3) is applicable.-   2: Declaration of any of a postal address, a name and a network    address in the profile-information as a privacy-guarding item of the    receiver 10 that needs to be protected by the privacy-guarding    functional unit 50 in presentation of a presented content to the    user by a content provider or declaration as to whether broadcasting    of contents or settlement of accounts is to be treated as an    operation entrusted to the privacy-guarding functional unit 50.-   3: The content provider does not allow the use of the    privacy-guarding functional unit 50 without regard to setting of a    privacy-guarding item of the receiver 10. The provider apparatus 2    declares that no transaction is closed if a name, a postal address    included in the profile-information of the receiver 10 is requested    but the receiver 10 does not present the required item.

The content provider is capable of making an appeal to users thatprivacy is protected by for example stating that privacy-guardinginformation is set so as to deliver a diet product Z to a customerthrough a privacy-guarding function operated by another company so thatpersonal information of a customer placing an order for a diet productwith this company is not received by this company.

As a static privacy-guarding item of the ID-assigning functional unit42, for example, it is possible to declare that, without regard tosetting of a privacy-guarding item by the content provider, during aperiod from 13:00 PM to 20:00 PM on each Thursday, a privacy-guardingitem set by the receiver 10 takes precedence of other items.

As a dynamic privacy-guarding item, for a rating of a content providerset at a predetermined value of typically 3, the followingprivacy-guarding item 1-1 or 1-2 can be declared without regard towhether or not setting of a privacy-guarding item prescribed by thecontent provider exists. For a rating of a content provider set at avalue other than the predetermined one, on the other hand, as a dynamicprivacy-guarding item of the receiver 10, the following privacy-guardingitem 2 can be declared.

-   1-1: Declaration of any of the profile-information, the additional    information and the response condition, which are generated by the    receiver 10, as an item absolutely desired by the content provider.-   1-2: Declaration of any of a postal address, a name and a network    address in the profile-information as a privacy-guarding item of the    receiver 10 to be protected by the privacy-guarding functional unit    50 in presentation of a presented content by a content provider or    declaration as to whether broadcasting of contents or settlement of    accounts is to be treated as an operation entrusted to the    privacy-guarding functional unit 50.-   2: The content provider does not allow the use of the    privacy-guarding functional unit 50 without regard to setting of a    privacy-guarding item of the receiver 10. The provider apparatus 2    declares that no transaction is closed if a name and a postal    address included in the profile-information of the receiver 10 is    requested but the receiver 10 does not present the required item.

The ID-assigning functional unit 42 is capable of recruiting a number ofmember stores by for example making an appeal to the stores that aprivacy-guarding item is set so that, in response to an order placedwith a group U of content providers participating in this service andparticularly handling adult commodities, the ordered content isdelivered to the customer by using a privacy-guarding function in auniform way so as to protect the confidentiality of the order.

If the verification functional unit 47 is capable of verifying a personspecified in a response condition of the receiver 10, as a dynamicprivacy-guarding item of the receiver 10, the following privacy-guardingitem 1-1 or 1-2 can be declared without regard to the existence ornon-existence of setting of privacy-guarding items prescribed by theprovider. If the verification functional unit 47 is not capable ofverifying a person specified in a response condition of the receiver 10,on the other hand, as a dynamic privacy-guarding item of the receiver10, the following privacy-guarding item 2 can be declared.

-   1-1: Declaration of any of the profile-information, the additional    information and the response condition, which are generated by the    receiver 10, as an item that can be presented by the receiver 10.-   1-2: Declaration of any of a postal address, a name and a network    address in the profile-information as a privacy-guarding item of the    receiver 10 desired by the user to be protected by the    privacy-guarding functional unit 50 in reception of a presented    content from a content provider or declaration as to whether    broadcasting of contents or settlement of accounts is to be treated    as an operation entrusted to the privacy-guarding functional unit    50.-   2: The receiver 10 is capable of declaring that a request made by    the content provider for a privacy-guarding item is accepted as it    is without regard to setting of an ordinary privacy-guarding item.

The verification functional unit 47 is capable of prompting a number ofusers to utilize the service by for example making an appeal to theusers that a privacy-guarding item is set so that, if the ageinformation included in profile-information indicated by a catalogedreceiver-ID is a phrase of “Under 18 years old”, a content is deliveredto the customer by using a privacy-guarding function in a uniform mannerso as to protect the confidentiality of the order.

As described above, privacy-guarding items set by the verificationfunctional unit 47, the ID-assigning functional unit 42, the receptionfunctional unit 53 and the provider functional unit 41 are stored by thesaving functional units 171 to 174. Thus, at a step S37 of the flowchartshown in FIG. 9, the evaluation-judging functional unit 175 employed inthe privacy-guarding functional unit 50 evaluates the privacy-guardingitems, determining whether or not the privacy-guarding functions can beproperly executed. That is to say, if a declared privacy-guarding itemis contradictory, its privacy-guarding function cannot be applied. Forexample, as described above, if the provider functional unit 41 makes arequest for presentation of profile-information by the receptionfunctional unit 53 but cannot receive the presentation, the fact that acontent cannot be presented is declared and, in addition, if there is alimitation that the reception functional unit 53 is not capable ofpresenting profile-information requested by a content provider, aprivacy-guarding function cannot be applied. If the receiver 10 consentsto presentation of profile-information requested by the contentprovider, on the other hand, a privacy-guarding function can be applied.

Thus, at the next step S38, the evaluation-judging functional unit 175employed in the privacy-guarding functional unit 50 forms a judgment asto whether a privacy-guarding function can or cannot be applied. If aprivacy-guarding function can be applied, the flow of the operationsgoes on to a step S39. At the step S39, the management functional unit176 reads out an item from the verification functional unit 47. The itemis deemed to be necessary among profile-information, additionalinformation ad a response condition, which are specified as a result ofevaluation of privacy-guarding items. An item that cannot be read outfrom the verification functional unit 47 is read out from the receptionfunctional unit 53.

At the next step S40, the privacy-guarding activation functional unit177 employed in the privacy-guarding functional unit 50 supplies theitem read out by the management functional unit 176 to thedatabase-creating functional unit 179. The database-creating functionalunit 179 assigns a temporarily set customer number to this item. Thedatabase-creating functional unit 179 further acquires a content ID anda provider ID, which are associated with a broadcasting reference ID ofinterest, and catalogs the content ID and the provider ID in a database51 by associating them with the customer number.

FIG. 22 is a diagram showing typical cataloging of data in the database51. In this example, the cataloged data is a name, a postal address, anetwork address, a method of account-settlement and a customer number.

At the next step S41, the order-placing-unit 180 employed in theprivacy-guarding functional unit 50 transmits the customer number andthe content ID to the provider functional unit 41 by way of the Internet1 to request the provider functional unit 41 that a content indicated bythe content ID be broadcasted to the order-placing-unit 180 of theprivacy-guarding functional unit 50. The provider functional unit 41transmits the content to the order-placing-unit 180 as requested and theorder-placing-unit 180 receives the content. At the next step S42, thecontent is directly passed on to the reception functional unit 53. Ifthe content is information that can be transmitted through the Internet1, the content is transmitted to the reception functional unit 53through the Internet 1.

The content may be held not by the provider functional unit 41 but bythe transaction functional unit 52 employed in the commerce server 9. Inthis case, the provider functional unit 41 requests theorder-placing-unit 180 to issue a request for the content to thetransaction functional unit 52. In accordance with this request, theorder-placing-unit 180 supplies information required for transmission ofthe content to the transaction functional unit 52 to request thetransaction functional unit 52 that a content be transmitted to thereception functional unit 53. The information includes the user's postaladdress, name and network address. As requested, the transactionfunctional unit 52 transmits the content to the reception functionalunit 53. That is to say, the order-placing-unit 180 transmits thecontent indirectly to the reception functional unit 53 in this case.

Then, at the next step S43, the order-placing-unit 180 searchesprivacy-guarding information, broadcasting of which is prohibited by theuser, for an account-settlement method specified by the user. This isbecause it is quite within the bounds of possibility that theaccount-settlement method supposed to be protected by theprivacy-guarding information is supplied to the content provider. At thenext step S44, the order-placing-unit 180 forms a judgment as to whetheror not it is quite within the bounds of possibility that theaccount-settlement method supposed to be protected by theprivacy-guarding information is supplied to the content provider. If itis quite within the bounds of possibility that the account-settlementmethod supposed to be protected by the privacy-guarding information issupplied to the content provider, the flow of the operations goes on toa step S46 at which the order-placing-unit 180 pays the fee in advancefor the customer by transmitting the customer number and anaccount-settlement method to the provider functional unit 41 as a set inorder to prevent the privacy-guarding information from being supplied tothe content provider. The account-settlement method transmitted to theprovider functional unit 41 is a method applied by theorder-placing-unit 180 to the provider functional unit 41 and not theaccount-settlement method specified by the user. Thus, even if theaccount-settlement method adopted by the order-placing-unit 180 istransmitted to the provider functional unit 41, the privacy informationof the user does not leak out.

The order-placing-unit 180 also settles an accurate account of thereception functional unit 53 for the advance payment made to theprovider functional unit 41. The user of the reception functional unit53 then makes a payment to the order-placing-unit 180.

If the outcome of the judgment formed at the step S44 indicates thatinforming the content provider of the account-settlement methodspecified by the user does not necessarily mean disclosure of privacyinformation to the provider, on the other hand, the flow of theoperations goes on to a step S45 at which the order-placing-unit 180transfers the account-settlement method specified by the user to theprovider functional unit 41. In this case, the provider functional unit41 issues a request for a payment of the fee to the user of thereception functional unit 53 on the basis of the account-settlementmethod of the user received from the order-placing-unit 180.

If the outcome of the judgment formed at the step S38 indicates that aprivacy-guarding function cannot be applied, on the other hand, the flowof the operations goes on to a step S47 at which the evaluation-judgingfunctional unit 175 examines use of a privacy-guarding function in atransaction. At the next step S48, the evaluation-judging functionalunit 175 forms a judgment as to whether or not a transaction not using aprivacy-guarding function has been selected. Assume for example that itis known that the user does not want any transaction not using aprivacy-guarding function, that is, the user always wants only atransaction using a privacy-guarding function, and it is known that, asa result of evaluation of a privacy-guarding item at the step S37, theoutcome of the judgment formed at the step S38 indicates disagreementwith a privacy-guarding item presented by the provider. In this case,the transaction can not be settled.

In this case, the flow of the operations goes on from the step S48 to astep S49 at which the evaluation-judging functional unit 175 terminatesprocessing without selecting a transaction and informs the user throughthe receiver that the processing has been terminated.

If the outcome formed at the step S48 indicates that a transaction notusing a privacy-guarding function has been selected, on the other hand,the flow of the operations goes on to a step S50 at which theprivacy-guarding deactivation functional unit 178 employed in theprivacy-guarding functional unit 50 notifies the verification functionalunit 47 that a privacy-guarding function is not used. At the step S50,the verification functional unit 47 informed of the fact that aprivacy-guarding function is not used transmits a provider ID, a contentID, a receiver-ID and profile-information to theprovider-address-identifying & connecting functional unit 44 employed inthe ID-assigning server 3 by way of the Internet 1. At the next stepS51, the provider-address-identifying & connecting functional unit 44searches the database 43 employed in the ID-assigning functional unit 42for a provider network address corresponding to the provider ID receivedat the step S50, and uses the network address of the provider toestablish a connection to the provider functional unit 41 through theInternet 1. Then, the provider-address-identifying & connectingfunctional unit 44 transmits the title of a content andprofile-information required for transmission of the content to theprovider functional unit 41, requesting the provider functional unit 41to present the content. The required profile-information transmitted tothe provider functional unit 41 includes a name, a postal address and anetwork address.

At the next step S52, the provider functional unit 41 delivers thespecified content to a user specified by theprovider-address-identifying & connecting functional unit 44. Then, theprovider functional unit 41 carries out necessary processing to settlean account with the user of the receiver 10.

Next, a concrete typical configuration of the receiver 10 is explainedby referring to FIGS. 23 and 24.

FIG. 23 is a diagram showing an external view of a typical configurationof the receiver 10. An active indicator 231 is turned on when a selectbutton 232 and a cancel button 233 are put in an operatable state by anactivate signal received from the broadcasting apparatus 5. On the otherhand, the active indicator 231 is turned off when the select button 232and the cancel button 233 are put in an unoperatable state by adeactivate signal received from the broadcasting apparatus 5.

The select button 232 is used by the user (the content recipient) toenter a response to a broadcasted question. To be more specific, anumber entered as a response is incremented by 1 each time the selectbutton 232 is pressed. The number of times the select button 232 waspressed so far is displayed on a select count display window 234. Thevalue of a response entered by pressing the select button 232, that is,a value displayed on the select count display window 234, is decrementedby 1 each time the cancel button 233 is pressed.

In order to enter the number 3 as a response to a question, for example,the user needs to press the select button 232 three times. If the userpresses the select button 232 four times by mistake, for example, theuser needs to press the cancel button 233 once. At that time, the selectcount display window 234 once displays the number 4 and eventuallydisplays a final answer of 3 (=4-1).

It should be noted that a response to a question displayed on the selectcount display window 234 is stored in a storage unit 249 shown in FIG.24, being associated with the question ID of the question.

If a content data sale service is rendered through radio broadcasting,for example, the select button 232 is also pressed to make a request fordownloading or recording of content data. The content data sale serviceis a service to sell compressed and encoded data of music broadcasted asan audio signal by multiplexing the data in a broadcasted signal. Thecompressed and encoded data is obtained as a result of encryption. Inthis case, if the cancel button 233 is pressed, the request fordownloading or recording of content data is canceled.

A content ID identifying content data downloaded by an operation topress the select button 232 is stored in the storage unit 249 shown inFIG. 24 much like a response to a question and other data. The contentID is embedded in the broadcasted signal.

A tuning slide 235 is operated to select a radio broadcasting station, abroadcast of which is to be received.

A transmit button 236 is pressed to set the receiver 10 in a responsedata transmission-mode. To put it concretely, the transmit button 236 ispressed to transmit a question ID stored in the storage unit 249 anddata such as a response associated with the question ID to theverification server 7. The transmit button 236 is also pressed toindicate a desire to purchase a decryption key of downloaded encrypteddata. That is to say, the transmit button 236 is pressed to make arequest for a transfer of the decryption key.

A speaker 237 outputs voices and sounds of a radio program. An antenna238 transmits a radio signal conveying a question ID stored in thestorage unit 249 and data such as a response associated with thequestion ID.

FIG. 24 is a diagram showing a typical electrical configuration of thereceiver 10. A control unit 241 employed in the receiver 10 controls adrive 242 to read out a control program from a magnetic disk 243, anoptical disk 244, a magnetic optical disk 245 or a semiconductor memory246. The control unit 241 also controls other components composing thereceiver 10 on the basis of operation information entered by the uservia an operation input unit 247 by execution of the control program readout by the drive 242.

When an activate signal is received by a received-signal separation unit251, for example, the control unit 241 controls a display control unit248 to turn on the active indicator 231 and controls an operation inputunit 247 to detect an operation to press the select button 232 or thecancel button 233. When a deactivate signal is received by thereceived-signal separation unit 251, on the other hand, the control unit241 controls the display control unit 248 to turn off the activeindicator 231 and controls the operation input unit 247 to ignore anoperation to press the select button 232 or the cancel button 233.

The operation input unit 247 detects an operation carried out by theuser on the select button 232, the cancel button 233, the tuning slide235 or the transmit button 236 and outputs information on the operationto the control unit 241. Controlled by the control unit 241, the displaycontrol unit 248 controls operations to turn on or off the activeindicator 231 and to display information on the select count displaywindow 234.

The storage unit 249 is used for storing a response, a question ID, andthe address of a response-collecting apparatus supplied thereto byoperating the select button 232 and the cancel button 233 as a set. Thestorage unit 249 is also used for storing a unique receiver-ID assignedto the receiver 10. It should be noted that the receiver-ID is not onlyused for identifying the receiver 10, but also used by an administratorfor identifying the user through management executed by associating thereceiver-ID with the profile of the user. In addition, the storage unit249 is also used for storing downloaded content data, that is,compressed and encoded data of music and the like. It should be notedthat the storage unit 249 can be integrated with the magnetic disk 243,the optical disk 244, the magnetic optical disk 245 or the semiconductormemory 246 into a single unit.

Controlled by the control unit 241, a station-selecting-unit 250receives a signal broadcasted by a radio broadcasting station selectedby the user by operating the tuning slide 235 and supplies the signal toa received signal separation unit 251. Also controlled by the controlunit 241, the received-signal separation unit 251 separates an audiosignal from the broadcasted signal and outputs the audio signal to acontent & question-playback unit 252. The received-signal separationunit 251 also separates signals other than the audio signal and acontent from the broadcasted signal and supplies the other signals tothe control unit 241. The other signals include a question ID, thenetwork address of a verification server 7 to receive a response fromthe user, an activate or deactivate signal and a decryption key. Inaddition, the received-signal separation unit 251 separates the contentfrom the broadcasted signal and supplies the content to the storage unit249.

The content & question-playback unit 252 plays back an audio signalreceived from the received-signal separation unit 251 and outputs asignal obtained as a result of the playback operation to the speaker237. In addition, the content & question-playback unit 252 also decodesencrypted content data read out from the storage unit 249 by using adecryption key received from the control unit 241, plays back a resultof decoding and outputs a signal obtained as a result of the playbackoperation to the speaker 237. The encrypted content data read out fromthe storage unit 249 is compressed and encoded data of music or thelike.

A communication unit 253 has a function equivalent to the datacommunication function of a hand phone or a PHS (Personal HandyphoneSystem). Controlled by the control unit 241, the communication unit 253reads out a data set comprising a response, a question ID and thenetwork address of a response-collecting apparatus from the storage unit249, adds the receiver-ID to the response and the question ID, andtransmits the response, the question ID and the receiver-ID to thenetwork address of the response-collecting apparatus as a radio signal.In addition, also on the basis of control executed by the control unit241, the communication unit 253 transmits information for applying for apurchase of a decryption key for decoding encrypted content data storedin the storage unit 249 to the broadcasting apparatus 5 as a radiosignal. In actuality, the information comprises a content ID and areceiver-ID.

As shown in FIG. 25, the broadcasting apparatus 5 outputs an audiosignal of question 1 or question 2 in a quiz or a questionnaire torespectively a period between times t0 and t2 or a period between timest4 and t6 during a program such as a disk jockey and music. At thattime, a question ID1 or a question ID2 for identifying question 1 andquestion 2 respectively are embedded in the broadcasted signal alongwith the network address of the verification server 7 for collectinganswers to the question. In addition, an activate signal is embeddedinto a period between times t1 and t3 slightly lagging behind the periodbetween the times t0 and t2 or a period between times t5 and t7 slightlylagging behind the period between the times t4 and t6 in the broadcastedsignal. A deactivate signal is embedded into other periods of thebroadcasted signal.

Thus, in the example shown in FIG. 25, the receiver 10 is allowed toaccept an answer to question 1 identified by the question ID1 from theuser only during the period between the times t1 and t3 and to accept ananswer to question 2 identified by the question ID2 only during theperiod between the times t5 and t7.

Next, reception processing carried out by the receiver 10 is explainedby referring to a flowchart shown in FIG. 26. The reception processingis started when the power supply of the receiver 10 is turned on.

The flowchart shown in FIG. 26 begins with a step S81 at which thestation-selecting-unit 250 employed in the receiver 10 receives abroadcasted signal from a radio broadcasting station selected byoperating the tuning slide 235 and outputs the signal to a component atthe following stage. As a result, voices and sounds of the selectedradio broadcasting station are output from the speaker 237.

At the next step S82, the control unit 241 controls the operation inputunit 247 so as to ignore operations carried out by the user on theselect button 232 and the cancel button 233. The control unit 241 alsocontrols the display control unit 248 to turn off the active indicator231. As a result, the select button 232 and the cancel button 233 areeach put effectively in a state of being disabled to generate inputsignals and the active indicator 231 is turned off. The active indicator231 is normally put in an off state. So, in this case, the off state issustained.

At the next step S83, the control unit 241 forms a judgment as towhether or not the transmit button 236 has been pressed to set theresponse data transmission-mode. If the outcome of the judgmentindicates that the response data transmission-mode has not been set, theflow of the reception processing goes on to a step S84.

At the next step S84, the control unit 241 forms a judgment as towhether or not an activate signal has been received. If the outcome ofthe judgment indicates that an activate signal has been received, theflow of the reception processing goes on to a step S85. At the step S85,the control unit 241 controls the operation input unit 247 so as todetect operations carried out by the user on the select button 232 andthe cancel button 233 and also controls the display control unit 248 toturn on the active indicator 231. As a result, the select button 232 andthe cancel button 233 are each put effectively in a state of beingenabled to generate input signals and the active indicator 231 is turnedon.

It should be noted that, if the outcome of the judgment formed at thestep S84 indicates that an activate signal has not been received, on theother hand, the processing of the step S85 is skipped.

At the next step S86, the control unit 241 forms a judgment as towhether or not the select button 232 and the cancel button 233 are eachput effectively in a state of being enabled to generate input signalsand an answer to a question has been entered by operating the selectbutton 232 and the cancel button 233. If the outcome of the judgmentindicates that the select button 232 and the cancel button 233 are eachput effectively in a state of being enabled to generate input signalsand an answer to a question has been entered by operating the selectbutton 232 and the cancel button 233, the flow of the receptionprocessing goes on to a step S87.

At the next step S87, the control unit 241 stores an answer entered byoperating the select button 232 and the cancel button 233 in response toa question, a question ID and the network address of a destination towhich the answer is to be transmitted in the storage unit 249. Thedestination is the verification server 7. In the following description,the answer, the question ID and the network address of the destinationare collectively referred to as answer-data.

It should be noted that, if the outcome of the judgment formed at thestep S86 indicates that the select button 232 and the cancel button 233have not each been put effectively in a state of being enabled togenerate input signals or an answer to a question has not been enteredby the user by operating the select button 232 and the cancel button233, on the other hand, the processing of the step S87 is skipped.

At the next step S88, the control unit 241 forms a judgment as towhether or not a deactivate signal has been received. If the outcome ofthe judgment indicates that a deactivate signal has been received, theflow of the reception processing goes on to a step S89. At the step S89,the control unit 241 controls the operation input unit 247 so as toignore operations carried out by the user on the select button 232 andthe cancel button 233. The control unit 241 also controls the displaycontrol unit 248 to turn off the active indicator 231. As a result, theselect button 232 and the cancel button 233 are each put effectively ina state of being disabled to generate input signals and the activeindicator 231 is turned off.

Then, the flow of the reception processing goes back to the step S83 tocarry out the processing repeatedly till the power supply of thereceiver 10 is turned off.

It should be noted that, if the outcome of the judgment formed at thestep S88 indicates that a deactivate signal has not been received, onthe other hand, the flow of the reception processing goes back directlyto the step S83, skipping the processing of the step S89. Then, theprocessing is carried out repeatedly till the power supply of thereceiver 10 is turned off.

By the way, if the outcome of the judgment formed at the step S83indicates that the answer-data transmission-mode has been set, on theother hand, the flow of the reception processing goes on to a step S90.

At the step S90, the control unit 241 carries out processing in theanswer-data transmission-mode. The processing in the answer-datatransmission-mode is explained by referring to a flowchart shown in FIG.27.

The flowchart shown in FIG. 27 begins with a step S101 at which thecontrol unit 241 forms a judgment as to whether or not the answer-datato be transmitted to the verification server 7 is stored in the storageunit 249. If the outcome of the judgment indicates that the answer-datato be transmitted to the verification server 7 is stored in the storageunit 249, the flow of the processing in the answer-datatransmission-mode goes on to a step S102.

At the step S102, the control unit 241 selects a piece of answer-datastored in the storage unit 249 and reads out the selected piece ofanswer-data. At the next step S103, the control unit 241 extracts thenetwork address of the verification server 7 serving as a destinationfrom the piece of answer-data read out from the storage unit 249.Controlled by the control unit 241, the communication unit 253 makes anaccess to the destination by dialing in order to establish acommunication.

At the next step S104, controlled by the control unit 241, thecommunication unit 253 transmits an answer and an answer ID included inthe answer-data to the verification server 7 accessed at the step S103.

At the next step S105, the control unit 241 forms a judgment as towhether or not a reception-apparatus ID is to be added to the answer andthe answer ID, which were transmitted at the step S104, and to betransmitted too. If the outcome of the judgment indicates that areception-apparatus ID is to be added and to be transmitted as well, theflow of the processing in the answer-data transmission-mode goes on to astep S106. It should be noted that, as a condition for determining thata reception-apparatus ID is to be added and to be transmitted in thisjudgment, the apparatus collecting answers desires such areception-apparatus ID and the user of the receiver 10 consents totransmission of the reception-apparatus ID. The existence ornon-existence of the answer collecting apparatus' desire for areception-apparatus ID is indicated by information embedded in thebroadcasted signal.

At the step S106, controlled by the control unit 241, the transmissionunit 253 transmits the reception-apparatus ID to the verification server7 accessed at the step S103. It should be noted that, if the outcome ofthe judgment formed at the step S105 indicates that areception-apparatus ID is not to be added and to be transmitted, on theother hand, the processing of the step S106 is skipped.

At the next step S107, controlled by the control unit 241, the storageunit 249 deletes the piece of answer-data transmitted at the step S104.At the next step S108, the control unit 241 forms a judgment as towhether or not the storage unit 249 still includes another piece ofanswer-data to be transmitted to the destination accessed at the stepS103 to establish a communication therewith. If the outcome of thejudgment indicates that such a piece of answer-data remains in thestorage unit 249 to be transmitted to the destination with anestablished communication, the flow of the processing in the answer-datatransmission-mode goes back to the step S104 to repeat the processingstarting with the step S104.

If the outcome of the judgment formed at the step S108 indicates that nomore piece of answer-data remains in the storage unit 249 to betransmitted to the destination with an established communication, on theother hand, the communication established at the step S103 isterminated. Then, the flow of the processing in the answer-datatransmission-mode goes back to the step S101 to repeat the processingstarting with the step S101.

If the outcome of the judgment formed at the step S101 indicates that noanswer-data to be transmitted is stored in the storage unit 249, on theother hand, the flow of the processing in the answer-datatransmission-mode goes on to a step S109. At the step S109, the controlunit 241 releases the receiver 10 from the answer-datatransmission-mode. The flow of the processing then goes back to the stepS82 of the flowchart shown in FIG. 26.

By virtue of the reception processing carried out by the receiver 10 asdescribed above, the user is capable of transmitting an answer to theverification server 7 automatically by merely pressing the transmitbutton 236 without performing processing to write words or to make aphone call.

In the reception processing described above, in the answer-datatransmission-mode set by pressing the transmit button 236, answer-datais transmitted. It should be noted, however, that answer-data can alsobe transmitted periodically such as every Monday or every weekend. As analternative, a piece of answer-data is transmitted only when the numberof pieces of answer-data stored in the storage unit 249 exceeds apredetermined number.

The following description explains processing carried out by thereceiver 10 to purchase content data sold by multiplexing the data in asignal broadcasted by the broadcasting apparatus 5 by referring to aflowchart shown in FIG. 28. The processing to purchase content data isstarted when the control unit 241 detects content data multiplexed in abroadcasted signal in a radio broadcast received by the receiver 10.

The flowchart shown in FIG. 28 begins with a step S121 at which thecontrol unit 241 forms a judgment as to whether or not an activatesignal has been received. The control unit 241 is in a wait state,forming the judgment repeated till the outcome of the judgment indicatesthat an activate signal has been received. As the outcome of thejudgment indicates that an activate signal has been received, thecontrol unit 241 controls the operation input unit 247 so as to detectoperations carried out by the user on the select button 232 and thecancel button 233 and also controls the display control unit 248 to turnon the active indicator 231. As a result, the select button 232 and thecancel button 233 are each put effectively in a state of being enabledto generate input signals and the active indicator 231 is turned on.

At the next step S122, the control unit 241 forms a judgment as towhether or not the select button 232 was pressed and the cancel button233 was not. If the outcome of the judgment indicates that the selectbutton 232 was pressed and the cancel button 233 was not, the flow ofthe purchase processing goes on to a step S123.

At the step S123, the storage unit 249 stores content data separated bythe received-signal separation unit 251 in accordance with controlexecuted by the control unit 241. At the next step S124, the storageunit 249 stores the content ID of the recorded content data inaccordance with control executed by the control unit 241.

It should be noted that if the outcome of the judgment formed at thestep S122 indicates that the select button 232 was not pressed or thecancel button 233 was pressed, on the other hand, the pieces ofprocessing of the steps S123 and S124 are skipped.

At the next step S125, the control unit 241 forms a judgment as towhether or not the transmit button 236 was pressed. If the outcome ofthe judgment indicates that the transmit button 236 was pressed, theflow of the purchase processing goes on to a step S126. At the stepS126, the transmission unit 253 transmits the content ID of a contentdata and the receiver-ID, which are stored in the storage unit 249, tothe broadcasting apparatus 5 in accordance with control executed by thecontrol unit 241.

At the next step S127, the control unit 241 forms a judgment as towhether or not a deactivate signal has been received. If the outcome ofthe judgment indicates that a deactivate signal has not been received,the flow of the purchase processing goes back to the step S122 to repeatthe processing starting with the step S122. If the outcome of thejudgment formed at the step S127 indicates that a deactivate signal hasbeen received, on the other hand, the control unit 241 controls theoperation input unit 247 so as to ignore operations carried out by theuser on the select button 232 and the cancel button 233 and alsocontrols the display control unit 248 to turn off the active indicator231. As a result, the select button 232 and the cancel button 233 areeach put effectively in a state of being disabled to generate inputsignals and the active indicator 231 is turned off.

As described above, if the outcome of the judgment formed at the stepS122 indicates that the select button 232 was not pressed or the cancelbutton 233 was pressed, the pieces of processing of the steps S123 andS124 are skipped. If the outcome of the judgment formed at the step S125indicates that the transmit button 236 was not pressed, on the otherhand, the processing of the step S126 is skipped.

In the processing to purchase content data as described above, encryptedcontent data is stored in the storage unit 249. In order to make arequest for a decryption key for decrypting the encrypted content data,it is necessary to transmit the content ID and the receiver-ID to thebroadcasting apparatus 5.

The broadcasting apparatus 5 transmits a decryption key indicated by thecontent ID received from the receiver 10 to the receiver 10 indicated bythe receiver-ID also received from the receiver 10.

In accordance with the above description, anadditional-information-inputting prompt is transmitted by multiplexingthe prompt with program data as tag codes. As an alternative, theadditional-information-inputting prompt can also be stored in thedatabase 43 of the ID-assigning functional unit 42. Then, inauthentication processing with the verification functional unit 47, theadditional-information-inputting prompt stored in the database 43 isdetected and used for prompting the user to enter additionalinformation.

In addition, while the receiver-management functional unit 48 isprovided in the verification server 7 in the embodiment described above,the receiver-management functional unit 48 can also be provided in thereceiver 10.

As an alternative, any 2 or more of the verification server 7, theprivacy-guarding server 8, the ID-assigning server 3 and the taggingserver 4 can be combined into a single server configuration, or thetagging server 4 can also be integrated with the broadcasting apparatus5 into a single unit.

Additional information can be entered in a variety of formats such asnumbers of the ten keys, a text generated by the keyboard or a handwritten letter recognizing device, graphics generated by a pen or amouse, a sound or a picture.

Profile-information of a user may include the age, content restrictions,a payment method, an occupation, a postal address, a name, an income, agender, information on airline mileage, customer numbers for a varietyof stores, favorite hotel rooms, information on smoking or non-smokingand other data, which are pertinent to the user.

In the processing described above, as settlement of an account, apayment can be made by using a credit card. However, theaccount-settlement method can also be determined from a gender and anoccupation included in the profile-information. Assume for example thata service is rendered to transmit data representing a digital picture ofcommodity A through a network in return for information on the age, thegender and the hobbies of a person interested in commodity A. In thiscase, the fee of the service is determined by the age, the gender andthe hobbies. The determination of the fee may also be regarded to fallwithin a broad definition of the meaning of an account-settlementmethod. In such a case, on the account-settlement method column of thedatabase 51 shown in FIG. 22, in place of a credit card number of VISA123 45678 XXXX, it is possible to prescribe a phrase stating: “Thegender, the occupation and other data included in theprofile-information.”

The restriction described as the time and date information of a responsecondition is not limited to an end time and date but can also be a starttime and date. While a time and date in a response condition accordingto the embodiment is acquired from the calendar timer 134 employed inthe receiver 10, the time and date can also be acquired from a calendartimer provided in the verification functional unit 47. In this case, atime and date obtained from the calendar timer provided in theverification functional unit 47 is corrected and set as a time and datein the response condition. In this way, a correct time and date can beobtained from information generated by the calendar timer provided inthe verification functional unit 47 even if the calendar timer 134provided in the receiver 10 is out of order. By providing a calendartimer in the receiver 10, however, it is possible to set a deadlinetaking a time zone having a difference in time into consideration. Therestriction described as the time and date information of a responsecondition is used typically as a use restriction related to the validityterm of a copyright of the content.

In a process of evaluation wherein a privacy-guarding item of a set iscompared with a privacy-guarding item of another set,character-to-character comparison can be implemented. As an alternative,a distance between regions specified in an area specifying process istreated as a variable of a function and evaluation can be carried out bycomparing the value of a function with the value of another function.

In addition, the evaluation and the comparison of privacy-guarding itemscan be carried out by functions in a broadcasted manner.

Disclosures of all pieces of profile-information, all responseconditions and all pieces of additional information to the contentprovider every time do not contribute to protection of privacy. Inaddition, the content provider does not always need all pieces ofprofile-information, all response conditions and all pieces ofadditional information. By storing all pieces of profile-information,all response conditions and all pieces of additional information in amemory, a memory with a large size is required inevitably. Furthermore,it is against the content provider's will to hold the providerresponsible for protection management only because the provider receivesa more amount of information than necessary. Thus, prescription ofprivacy-guarding items is also meaningful to the content provider sincesuch prescription allows the provider to take in only necessaryinformation. As for the user, it is possible to present itself as ananonymous participant.

Tag codes, a provider ID, a content ID, a broadcasting serial ID, aresponse condition, profile-information, additional information andother data, which are held by the receiver 10, are stored in a memorythat can be removed from the receiver 10 when necessary. Examples ofsuch a memory are an IC card, a memory card, a memory stick (trademark),a CD, an MD, a hard disk, another kind of magnetic recording media andan optical recording medium. In this way, by connecting the main unit ofthe receiver 10 to the verification functional unit 47 or by connectingonly such a memory to the verification functional unit 47, it ispossible to carry out verification.

The above description explains an example in which the present inventionis applied to satellite digital radio communication. As explained as thespecifications shown in FIG. 14, however, tag-data can be broadcasted byadoption of the multi-cast technique using the hand phone or theInternet or by adopting another communication technique such assatellite television, ground-wave television, ground-wave radio, CATV orsatellite-data communication.

The series of pieces of processing described above can be carried out byhardware or through execution of software. When execution of software isselected for carrying out the series of pieces of processing, a varietyof programs composing the software are executed by a computerincorporated in special hardware. As an alternative, the programs areinstalled in a recording memory employed in typically a general purposepersonal computer capable of executing the programs to carry out thepieces of processing.

As shown in FIG. 3, a recording medium for presenting a program to theuser is broadcasted separately from the main unit of the apparatus. Inorder to present a program to the user, however, the use of packagemedia is not mandatory. As mentioned before, examples of the packagemedia are the magnetic disk 71 including a floppy disk, the optical disk72 including a CD-ROM (Compact Disk Read Only Memory) and a DVD (DigitalVersatile Disk), the magnetic optical disk 73 including an MD (MiniDisk) and the semiconductor memory 74. As an alternative, a program canalso be presented to the user by incorporating the program in the mainunit of the apparatus in advance. That is to say, the program is storedin a ROM 62 or a hard disk included in the storage unit 68.

It should be noted that, in this specification, while steps prescribedin a program recorded in a recording medium can of course be executedsequentially along the time axis in an order the steps are prescribed inthe program, the steps are not always executed sequentially along thetime axis. That is to say, a program may include steps that are executedconcurrently or independently.

In addition, the technical term ‘system’ used in this specificationmeans the whole equipment comprising a plurality of apparatuses.

In accordance with the system described above, the following effects areexhibited.

-   1: The ID assignment function and the verification function are    separated from content providers and shared by the providers as    functions independent of the providers. Thus, the functions can be    provided for a plurality of content providers.-   2: By carrying out a tagging process and enclosing a portion relying    on media in a tag, the portion can be made independent of the ID    assignment function and the verification function and, therefore,    the functions can be provided for a plurality of media.-   3: By allowing the ID assignment function on the content sender side    and the verification function on the content recipient side to share    information, responses from recipients can be collated with    offerings broadcasted by broadcasting by using a mechanized means    with a higher degree of efficiency.-   4: By leaving a validity-condition set by a content provider with    the ID assignment function, the validity-condition can be collated    with a receiver's response condition, profile-information and    additional information by using a mechanized means with a higher    degree of efficiency.-   5: A mechanically collectable environment of a receiver which is    dependent on a response condition can be collated with a    validity-condition.-   6: A receiver's environment cataloged in advance from    profile-information can be collated with a validity-condition.-   7: Information input from a receiver on the spot as additional    information can be collated with a validity-condition.-   8: Since privacy-guarding items can be left with a privacy-guarding    functional unit, privacy-guarding items declared by the presentation    functional unit, an ID assignment functional unit, a verification    functional unit and the reception functional unit can be collated    with each other by using a mechanized means. As a result, an    anonymous person is capable of obtaining a content.-   9: Since a function to order and deliver an actual commodity, that    is, a content, and a function to determine a price for the commodity    are separated from and made independent of a presentation functional    unit and a reception functional unit, it is possible to implement a    system adaptable to a variety of digital content secured deliveries    and various kinds of commodity and financial circulation.

1. A computer-readable recording medium including computer programinstructions, which when executed by hardware cause the hardware toperform a method of privacy guarding, comprising: receiving user profileinformation, privacy-guarding data of a user, and privacy-guarding dataof a content provider, wherein the privacy-guarding data of a userdefines each of a plurality of parameters in the user profile as beingone of a static privacy guarded parameter or a dynamic privacy guardedparameter; determining, based on the privacy-guarding data of a user andthe privacy-guarding data of a content provider, whether a privacyfunction is activated; requesting content from the content providerbased on a request received from an information processing apparatuscorresponding to the user; transmitting, when the privacy guardingfunction is not activated, a notification that the privacy function isnot activated; transmitting at least a portion of the user profile tothe contents provider if the privacy function is activated, wherein theat least portion of the user profile transmitted are defined as notguarded by the privacy-guarding data of a user; controlling transmissionof a dynamic privacy guarded parameter to the content provider based ona rating of the content provider included in the privacy guarding dataof the content provider; controlling transmission of a static privacyguarded parameter to the content provider regardless of a rating of thecontent provider included in the privacy guarding data of the contentprovider; and paying a fee for the requested content to the contentprovider on behalf of the user when data of the user profile defined asguarded by the privacy-guarding data of the user includes a user'saccount settlement method.
 2. The method of claim 1, wherein theprivacy-guarding data of a user defines a plurality of parameters in theuser profile to either be privacy guarded parameters or non-privacyguarded parameters.
 3. The method of claim 1, wherein the notificationthat the privacy function is not activated is transmitted to theinformation processing apparatus corresponding to the user.
 4. Themethod of claim 1, wherein the notification that the privacy function isnot activated is transmitted to a verification unit, which, uponreceiving the notification, is configured to initiate an exchange of theuser profile information to the content provider.
 5. A privacy guardingapparatus, comprising: an interface configured to receive user profileinformation, privacy-guarding data of a user, and privacy-guarding dataof a content provider, wherein the privacy-guarding data of a userdefines each of a plurality of parameters in the user profile as beingone of a static privacy guarded parameter or a dynamic privacy guardedparameter; a module configured to determine, based on theprivacy-guarding data of a user and the privacy-guarding data of acontent provider, whether a privacy function is activated; an interfaceconfigured to request content from the content provider based on arequest received from an information processing apparatus correspondingto the user; an interface configured to transmit, when the privacyguarding function is not activated, a notification that the privacyfunction is not activated; an interface configured to transmit at leasta portion of the user profile to the contents provider if the privacyfunction is activated, wherein the at least portion of the user profiletransmitted are defined as not guarded by the privacy-guarding data of auser; and an order placing unit configured to pay a fee for therequested content to the content provider on behalf of the user whendata of the user profile defined as guarded by the privacy-guarding dataof the user includes a user's account settlement method, wherein theinterface is configured to control transmission of a dynamic privacyguarded parameter to the content provider based on a rating of thecontent provider included in the privacy guarding data of the contentprovider, and the interface is configured to control transmission of astatic privacy guarded parameter to the content provider regardless of arating of the content provider included in the privacy guarding data ofthe content provider.
 6. The apparatus of claim 5, wherein theprivacy-guarding data of a user defines a plurality of parameters in theuser profile to either be privacy guarded parameters or non-privacyguarded parameters.
 7. The apparatus of claim 5, wherein the interfaceis configured to transmit the notification that the privacy function isnot activated to the information processing apparatus corresponding tothe user.
 8. The apparatus of claim 5, wherein the interface isconfigured to transmit the notification that the privacy function is notactivated to a verification unit, which, upon receiving thenotification, is configured to initiate an exchange of the user profileinformation to the content provider.